SSRF DDoS 漏洞
Open
- Dominant language
- Python
- Stars
- 5.3k
- Forks
- 1.6k
- PR merge metrics
- No merged PRs in 30d
Description
當bot接收到以下文字消息會觸發 SSRF，由於現在沒有異步，如果請求文件很大會拒絕服務造成 DDoS。
```
http://speedtest.tele2.net/1000GB.zip#http://weixin.qq.com/cgi-bin/redirectforward?args=
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the report with the supplied message containing the speedtest.tele2.net URL, then trace the bot's message-handling and outbound-request paths. The issue names no files or tests; done would require preventing the reported SSRF-triggered large-download denial of service and adding coverage for the input.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 15/100