CVE-2026-41603 Apache Thrift证书验证不当漏洞

import socket import ssl # Conceptual PoC for CVE-2026-41603 # This script demonstrates the behavior of a vulnerable Thrift client # that accepts a certificate with a hostname mismatch. def connect_vulnerable(target_host, target_port): # Create a standard SSL context context = ssl.create_default_context() # VULNERABILITY: The hostname check is disabled or not performed correctly. # In the vulnerable Apache Thrift < 0.23.0, this check might be missing. context.check_hostname = False # For demonstration, we might also skip verifying the CA chain if needed, # but the CVE specifically mentions Host Mismatch. # context.verify_mode = ssl.CERT_NONE print(f"[+] Attempting to connect to {target_host}:{target_port}...") try: with socket.create_connection((target_host, target_port)) as sock: with context.wrap_socket(sock, server_hostname=target_host) as ssock: print(f"[+] Connection established!") print(f"[+] Peer certificate: {ssock.getpeercert()}") print("[!] Vulnerability exploited: Connection accepted despite potential hostname mismatch.") return True except Exception as e: print(f"[-] Connection failed: {e}") return False if __name__ == "__main__": # Example usage (requires a server to test against) # connect_vulnerable("example.com", 443) pass