CVE-2026-7581 MeTube跨域策略配置错误漏洞

import requests # Target vulnerable MeTube instance target_url = "http://localhost:8081" malicious_origin = "http://attacker.com" headers = { "Origin": malicious_origin, "User-Agent": "Mozilla/5.0 (PoC Scanner)" } print(f"[*] Testing CORS on {target_url}") print(f"[*] Sending Origin: {malicious_origin}") try: response = requests.get(target_url, headers=headers) # Check for CORS headers acao = response.headers.get("Access-Control-Allow-Origin") acac = response.headers.get("Access-Control-Allow-Credentials") print(f"[+] Response Access-Control-Allow-Origin: {acao}") print(f"[+] Response Access-Control-Allow-Credentials: {acac}") # Determine if vulnerable if acao == "*": print("[!] VULNERABLE: CORS allows any origin (*).") elif acao == malicious_origin: if acac == "true": print("[!] VULNERABLE: CORS reflects specific origin and allows credentials.") else: print("[!] POTENTIALLY VULNERABLE: CORS reflects specific origin.") else: print("[-] Not vulnerable or strict policy in place.") except Exception as e: print(f"[-] Error connecting to target: {e}")