George0Papasotiriou/CVE-2026-8080-DKIM-Signature-Verification-Bypass-Header-Canonicalization-Flaw-
GitHub: George0Papasotiriou/CVE-2026-8080-DKIM-Signature-Verification-Bypass-Header-Canonicalization-Flaw-
该项目通过 Python 模拟演示了一个存在 Header Canonicalization 缺陷的 DKIM 验证器，展示了攻击者如何通过注入额外 header 绕过 DKIM 签名验证。
Stars: 0 | Forks: 0
## CVE-2026-8080 – DKIM 签名验证绕过（Header Canonicalization 漏洞）
### **程序代码（Python email 解析模拟）**
```
# dkim_verifier_sim.py - 有缺陷的 DKIM verifier
import re, hashlib
# 带有 DKIM signature 的模拟 email
raw_email = b"""From: admin@example.com
To: victim@example.com
Subject: Hello
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=mail; h=from:to:subject;
b=abc123; bh=def456;
X-Extra: injected
This is a test.
"""
def parse_headers(raw):
headers = {}
lines = raw.decode().split('\r\n')
for line in lines:
if ': ' in line:
key, val = line.split(': ', 1)
headers[key.lower()] = val
return headers
def verify_dkim(raw):
headers = parse_headers(raw)
# Vulnerability: canonicalisation does not remove extra headers not in the 'h' list
# According to RFC, only headers listed in 'h' are signed, but the verifier should exclude others.
# Here we simulate that extra header 'x-extra' is mistakenly included in the hash computation
# because the verifier canonicalizes all headers instead of just the listed ones.
signed_headers = headers['dkim-signature'].split('h=')[1].split(';')[0].split(':')
# Build header list for hash
header_block = ""
for h in signed_headers:
header_block += f"{h}:{headers[h]}\r\n"
# Flaw: include extra header X-Extra because it's present in the actual headers
if 'x-extra' in headers:
header_block += f"x-extra:{headers['x-extra']}\r\n"
# Now compute hash and compare... For demo, we'll just print that verification succeeds incorrectly.
print("Verification passed (incorrectly includes extra header)")
verify_dkim(raw_email)
```
# CVE-2026-8080 – DKIM 签名验证绕过（Header Canonicalization 错误）
## 概述
某邮件服务器的 DKIM 验证器未严格遵循 RFC 6376 中定义的 canonicalization 算法。它在哈希计算中包含了额外的 header 字段，使得攻击者能够追加一个 header（例如 `X-Extra: injected`）来改变电子邮件的行为，同时其签名依然能通过验证。
## 漏洞详情
- **类型：** Cryptographic Verification Bypass
- **影响：** Email 欺骗、网络钓鱼、绕过垃圾邮件过滤器。
- **根本原因：** 验证器对**所有**存在的 header 进行 canonicalize 处理，而不是仅处理 `h=` tag 中列出的 header，导致已签名的内容与实际验证的内容不匹配。
## 漏洞利用演示
运行模拟的缺陷验证器：
```
python dkim_verifier_sim.py
```
即使添加了额外的 header，它依然会输出“验证通过”。
标签：DKIM, Python, 无后门, 漏洞分析, 电子邮件安全, 路径探测, 身份验证绕过, 逆向工具