漏洞报告 #3480039 - WebSocket逻辑错误：控制帧（PING/PONG）饥饿导致大数据传输期间连接中断（DoS）

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

import socket
import struct
import time
import threading
import select

OP_PING = 0x9
OP_PONG = 0xA
def create_frame(opcode, payload=b""):
    b1 = 0x80 | opcode
    b2 = len(payload) & 0x7F
    return struct.pack("!BB", b1, b2) + payload
def handle_client(conn):
    print("[+] Client connected. Handshaking...")
    try:
        req = conn.recv(4096)
        resp = (
            b"HTTP/1.1 101 Switching Protocols\r\n"
            b"Upgrade: websocket\r\n"
            b"Connection: Upgrade\r\n"
            b"Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=\r\n"
            b"\r\n"
        )
        conn.sendall(resp)
        print("[+] Handshake OK. Monitoring Heartbeat...")
        last_pong_time = time.time()
        running = True
        def pinger():
            nonlocal last_pong_time, running
            while running:
                try:
                    time.sleep(1)
                    conn.sendall(create_frame(OP_PING, b"alive?"))
                    if time.time() - last_pong_time > 3:
                        print("\n[!!!] TIMEOUT: Client did not reply PONG in 3s!")
                        running = False
                        conn.close()
                        return
                except:
                    running = False
                    return
        t = threading.Thread(target=pinger)
        t.start()
        while running:
            ready = select.select([conn], [], [], 1)
            if ready[0]:
                data = conn.recv(1024)
                if not data: break
                opcode = data[0] & 0x0F
                if opcode == OP_PONG:
                    last_pong_time = time.time()
    except:
        pass
def start_server():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    s.bind(('0.0.0.0', 9090))
    s.listen(1)
    print("[*] Strict Server on 9090...")
    while True:
        conn, addr = s.accept()
        handle_client(conn)
if __name__ == "__main__":
    start_server()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <curl/curl.h>

int main(void) {
    CURL *curl;
    CURLcode res;
    curl_global_init(CURL_GLOBAL_DEFAULT);
    curl = curl_easy_init();
    if(curl) {
        // Connect to local strict server
        curl_easy_setopt(curl, CURLOPT_URL, "ws://127.0.0.1:9090/");
        curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 2L);
        res = curl_easy_perform(curl);
        if(res != CURLE_OK) return 1;
        size_t sent;
        char buffer[1024];
        memset(buffer, 'A', sizeof(buffer));
        const struct curl_ws_frame *meta;
        size_t rlen;
        char rbuf[256];
        // Send massive data stream
        for(int i=0; i<100000; i++) {
            // 1. Send Data (CURLWS_BINARY)
            res = curl_ws_send(curl, buffer, sizeof(buffer), &sent, 0, CURLWS_BINARY);
            if(res != CURLE_OK) break;
            // 2. Sleep briefly to allow Server to send PING
            usleep(10000); 
            // 3. Call recv to process incoming PING
            // EXPECTED: Curl should reply PONG immediately.
            // ACTUAL: Curl queues PONG behind the data stream because payload_remain > 0.
            curl_ws_recv(curl, rbuf, sizeof(rbuf), &rlen, &meta);
        }
    }
    curl_easy_cleanup(curl);
    curl_global_cleanup();
    return 0;
}

1

[!!!] TIMEOUT: Client did not reply PONG in 3s!