abraxas/openmeetings-nettest-ping-dosApache OpenMeetings 9.1.0 - High - Remote - DoS leftover - unauth NetTest ping POST reads body to EOF
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · openmeetings-nettest-ping-dos
Class: DoS leftover Reach: Remote
Apache OpenMeetings 9.1.0. Leftover of CVE-2021-27576. RateLimitRequestFilter returns early for type=ping and type=jitter (no 3s delay, no 50-client cap). POST still hits NetTestWebService.upload, which reads the entity stream to EOF. Needs a Wicket JSESSIONID from /signin or /hash?app=network. No login.
| ID | no CVE yet |
| Class | DoS leftover |
| Reach | Remote (unauthenticated, session cookie only) |
| CWE | CWE-770 |
| CVSS | High: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Product | Apache OpenMeetings 9.1.0 |
| Auth | none (JSESSIONID from GET /signin) |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:18153 only. 8 MiB body, not gigabytes. |
| Method | Sink | Privilege |
|---|---|---|
POST /services/networktest/?type=ping 8 MiB | upload reads to EOF (NetTestWebService.java:176-195) | Availability (lab-proven): two parallel pings both 200, bytes=8388608. Immediate ping after upload 429 still 200. |
Control type=upload | RateLimitRequestFilter 3s / 50-client | Closed on upload: first 200, immediate second 429. |
Closed: GET download size cap 5 MiB. No cookie → ping 403. Official JS uses type=upload.
cd lab
./run.sh
Last line: SUCCESS OPENMEETINGS-NETTEST-PING-WITNESS
Suggested fix: apply the same delay and client cap to ping/jitter POST, or reject a body on ping.
Abraxas Labs - https://abraxaslabs.tech - https://github.com/abraxas - https://x.com/abraxas_null - [email protected]
Vendor: [email protected]