Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-48710 — CVE-2026-48710漏洞验证代码 | Kitploit
Tools/GitHubGitHub/cuteecat/cve-2026-48710
Authentication & AuthorizationVulnerability AnalysisWeb Application ExploitationWeb Security
GitHubcuteecat/cve-2026-48710

CVE-2026-48710

CVE-2026-48710漏洞验证代码

View Repository
9 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-48710

Principle:

Starlette is an open-source, lightweight Python ASGI framework.
The root cause is that when processing URL data structures, Starlette trusts the host sent by the client and directly concatenates it into the url variable for subsequent authentication handling.

The raw URL is processed in uvicorn\protocols\http\httptools_impl.py
def on_message_begin(self) -> None: self.url = b"" self.expect_100_continue = False self.headers = [] self.scope = { "type": "http", "asgi": {"version": self.asgi_version, "spec_version": "2.3"}, "http_version": "1.1", "server": self.server, "client": self.client, "scheme": self.scheme,
"root_path": self.root_path, "headers": self.headers, "state": self.app_state.copy(), }

root@kitploit:~
# Parser callbacks
def on_url(self, url: bytes) -> None:
    self.url += url #self.url设置为原始url

def on_header(self, name: bytes, value: bytes) -> None:
    name = name.lower()
    if name == b"expect" and value.lower() == b"100-continue":
        self.expect_100_continue = True
    self.headers.append((name, value))

def on_headers_complete(self) -> None:
    http_version = self.parser.get_http_version()
    method = self.parser.get_method()
    self.scope["method"] = method.decode("ascii")
    if http_version != "1.1":
        self.scope["http_version"] = http_version
    if self.parser.should_upgrade() and self._should_upgrade():
        return
    parsed_url = httptools.parse_url(self.url)#使用httptools拆分原始url
    raw_path = parsed_url.path  #raw_path设置为原始url拆分出的path(访问的path)
    path = raw_path.decode("ascii")  #path设置为使用ascii解码以后的原始path值
    if "%" in path:  #处理url解码以后的中文从重编码
        path = urllib.parse.unquote(path)
    full_path = self.root_path + path
    full_raw_path = self.root_path.encode("ascii") + raw_path
    self.scope["path"] = full_path
    self.scope["raw_path"] = full_raw_path
    self.scope["query_string"] = parsed_url.query or b""

(I typed these comments by hand.)

This code is inside the class URL: method.

Code: \starlette\datastructures.py

host_header = None for key, value in scope["headers"]: if key == b"host": host_header = value.decode("latin-1") break if host_header is not None: url = f"{scheme}://{host_header}{path}" #基于用户传入的请求头二次定义url

In starlette\routing.py:

root@kitploit:~
    route_path = get_route_path(scope)
    if scope["type"] == "http" and self.redirect_slashes and route_path != "/":
        redirect_scope = dict(scope)
        if route_path.endswith("/"):
            redirect_scope["path"] = redirect_scope["path"].rstrip("/")
        else:
            redirect_scope["path"] = redirect_scope["path"] + "/"

        for route in self.routes:
            match, child_scope = route.matches(redirect_scope)
            if match != Match.NONE:
                redirect_url = URL(scope=redirect_scope)   #调用URL方法
                response = RedirectResponse(url=str(redirect_url))
                await response(scope, receive, send)
                return

As a result, when a user sends a malformed request with a host header to an endpoint that requires authentication, the url is redefined at the routing layer as an endpoint that does not require authentication.
For example, at http://127.0.0.1:9999/admin, admin in this URL is an endpoint that requires authentication.
Send the packet:
url = http://127.0.0.1:9999/admin
header{
host = 123?
}
The url is redefined as http://123?/admin.
At this point, use the urlsplit function to parse the url:
The result is SplitResult(scheme='http', netloc='123', path='', query='/admin', fragment='')
Because path='', the subsequent authentication logic considers that the user is accessing the website root directory, so it passes directly, and actually returns the content of the admin directory.

Download Tool