CVE-2026-33487 goxmlsig签名验证绕过漏洞

// PoC Concept: Demonstrating the loop variable capture issue in Go < 1.22 // This code simulates the vulnerable logic in goxmlsig validate.go package main import ( "fmt" ) // Reference simulates the struct in goxmlsig type Reference struct { ID string Data string } func vulnerableValidate(targetID string, refs []Reference) *Reference { var matchedRef *Reference for _, _ref := range refs { if _ref.ID == targetID { // VULNERABILITY: Taking address of the loop variable "_ref" // In Go < 1.22, this address is reused for every iteration. matchedRef = &_ref } } return matchedRef } func main() { // Scenario: We want to validate "TargetElement" // The attacker provides a list where "TrustedElement" is last. refs := []Reference{ {ID: "TargetElement", Data: "Malicious Data"}, {ID: "TrustedElement", Data: "Valid Signed Data"}, } // Attempt to find the reference for "TargetElement" found := vulnerableValidate("TargetElement", refs) if found != nil { fmt.Printf("Found ID: %s\n", found.ID) fmt.Printf("Found Data: %s\n", found.Data) // In Go < 1.22, due to the bug, found.Data will be "Valid Signed Data" // even though we searched for "TargetElement". // This causes the validation to pass incorrectly. if found.Data == "Malicious Data" { fmt.Println("Detected Malicious Data (Expected behavior in secure code)") } else { fmt.Println("Validation Bypassed! Pointed to wrong element.") } } }