CVE-2018-16789

Published: Mar 21, 2019Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down.

Affected (1)

Products: Shellinabox Project: Shellinabox

Shellinabox Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Shellinabox Project Shellinabox	Up to 2.20

Related CWEs

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (8)

http://packetstormsecurity.com/files/149978/Shell-In-A-Box-2.2.0-Denial-Of-Service.html

Source: cve@mitre.org

ExploitPatchThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2018/Oct/50

Source: cve@mitre.org

ExploitMailing ListPatchThird Party Advisory

https://code.google.com/archive/p/shellinabox/issues

Source: cve@mitre.org

Third Party Advisory

https://github.com/shellinabox/shellinabox/commit/4f0ecc31ac6f985e0dd3f5a52cbfc0e9251f6361

Source: cve@mitre.org

PatchThird Party Advisory

http://packetstormsecurity.com/files/149978/Shell-In-A-Box-2.2.0-Denial-Of-Service.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2018/Oct/50

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListPatchThird Party Advisory

https://code.google.com/archive/p/shellinabox/issues

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/shellinabox/shellinabox/commit/4f0ecc31ac6f985e0dd3f5a52cbfc0e9251f6361

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.