Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2019-5010 PoC — Python X509证书解析器代码问题漏洞

Source
Associated Vulnerability
Title:Python X509证书解析器代码问题漏洞 (CVE-2019-5010)
Description:Python是Python软件基金会的一套开源的、面向对象的程序设计语言。该语言具有可扩展、支持模块和包、支持多种平台等特点。 Python 2.7.11版本和3.7.2版本中的X509证书解析器存在代码问题漏洞。攻击者可借助特制的X509凭证利用该漏洞造成拒绝服务(空指针逆向引用)。
Description
CVE-2019-5010 Exploit PoC - Python Denial of Service via Malformed X.509v3 Extension
Readme
# CVE-2019-5010

* Author: [Jonathan M. Wilbur](https://github.com/JonathanWilbur) <[jonathan@wilbur.space](mailto:jonathan@wilbur.space)>
* Copyright Year: 2019
* License: [MIT License](https://mit-license.org/)

## How to use

1. Install all dependencies by running `npm install`.
2. Compile the project using `npm run build`.
3. Run `node ./dist/index.js` to create the evil certificate in `./dist/cve-2019-5010-cert.pem`.
4. Bring up the victim container with `docker-compose up`.

This is honestly probably the most unimpressive exploit ever. The docker
container will crash with exit code 139 if you are successful and 0 if
the exploit does not work.
File Snapshot

[4.0K] /data/pocs/78b9d0183a64ae5693c508e3e39260adec05dbd3 ├── [ 279] babel.config.js ├── [3.6K] CONTRIBUTING.md ├── [ 401] docker-compose.yaml ├── [ 153] Dockerfile ├── [4.0K] documentation ├── [1.1K] Jenkinsfile ├── [6.3K] jest.config.js ├── [1.1K] LICENSE.txt ├── [ 46] Makefile ├── [1.7K] package.json ├── [460K] package-lock.json ├── [ 673] README.md ├── [2.1K] serverless.yml ├── [4.0K] source │   ├── [ 425] demo.py │   ├── [3.3K] generateCertificate.ts │   └── [ 246] index.ts ├── [4.0K] test │   ├── [4.0K] jest │   │   └── [ 71] index.test.js │   └── [ 451] testpage.html ├── [1.5K] tsconfig.json └── [ 717] webpack.config.js 4 directories, 19 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.