README.md

metadata

tags:
  - security
  - proof-of-concept
  - protobuf
license: mit

Protocol Buffers DotnetSettings forced_namespace_aliases materialization DoS PoC

This repository contains a benign security research PoC for a .pb artifact that drives repeated-string materialization during client_pb2.DotnetSettings.ParseFromString(...).

Files:

• control_one_forced_namespace_alias.pb
• malicious_forced_namespace_aliases_5000000.pb
• reproduce.py

Exact public file URLs:

• https://huggingface.co/hacnho/protobuf-dotnetsettings-forced-namespace-aliases-dos-poc/resolve/main/control_one_forced_namespace_alias.pb
• https://huggingface.co/hacnho/protobuf-dotnetsettings-forced-namespace-aliases-dos-poc/resolve/main/malicious_forced_namespace_aliases_5000000.pb
• https://huggingface.co/hacnho/protobuf-dotnetsettings-forced-namespace-aliases-dos-poc/resolve/main/reproduce.py

Expected signal:

• control:
  • forced_namespace_aliases_len = 1
  • first_forced_namespace_alias_len = 9999995
• malicious:
  • forced_namespace_aliases_len = 5000000
• latest local replay:
  • vmhwm_delta_kb = 199804
  • elapsed_ratio = 11.38
• latest public replay:
  • vmhwm_delta_kb = 199880
  • elapsed_ratio = 11.45