CVE-2026-114611— OCO-Server MDM 身份泄露与设备劫持漏洞
一分钟漏洞结论
影响对象
schorschii OCO-Server
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
OCO-Server 是一款自托管的终端管理应用，用于计算机资产盘点、软件部署以及移动设备管理。在 1.2.3 版本之前，Apple MDM 注册端点 在使用 验证签名的注册请求 plist 时，启用了 标志。该标志会禁用对签名者证书链及其信任关系的验证，因此签名仅需与 PKCS#7 数据块中嵌入的任意证书保持内部自洽即可。这意味着，攻击者使用与其无关的自签名证书所生成的签名也会被接受。 由于该端点信任从未经验证的载荷中提取的 （序列号）字段，任何知晓已注册设备序列号的人，均可使用任意自签名证书，伪造一个 plis
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-114611 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack
来源: CVE Program / CVE List V5
Vulnerability Description
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (`SERIAL` = victim device, attacker-chosen `UDID`) with an arbitrary self-signed certificate; POST it unauthenticated to `/api-mdm.php/profile` (Content-Type: `application/pkcs7-signature`); and receive the victim device's freshly minted MDM identity: a certificate with `CN=<serial>` issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned `.mobileconfig` enrollment profile. Additionally, the victim's `mobile_device` database row is silently overwritten with the attacker-supplied `UDID` (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (`/checkin`, `/mdm`, `/parameters`), which authenticate callers by the certificate CN (the serial number) via `checkSignature()` in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| schorschii | OCO-Server | < 1.2.3 | - |
|
二、漏洞 CVE-2026-114611 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-114611 的情报信息
请登录查看更多情报信息。
CVE-2026-114611 其他参考 (3)
-
https://github.com/schorschii/OCO-Server/security/advisories/GHSA-p549-5h7r-7639 x_refsource_CONFIRM
同批安全公告 · schorschii · 2026-10-22 · 共 3 条
| CVE-2026-61791 | 7.4 HIGH | OCO-Server 命令按钮代理主机名存储型 XSS 漏洞 |
| CVE-2026-114515 | 6.5 MEDIUM | OCO-Server 自助门户卸载作业授权绕过漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-114611
暂无评论