Advisory: DoS against Telligent Community Server Advisory ID: 4tphi-sa-20070111-communityserver Release Date: 01-24-2007 Author: Blake Matheny (bmatheny (at) mobocracy (dot) net [email concealed]) Software: Community Server <= 2.1 Impact: Remote DoS Overview: From Wikipedia, "Community Server is a community collaboration platform that consists of a core blog, forums, photo gallery, and file sharing system." Several weaknesses have been found in the pingback specification which has been implemented by Community Server as well as other vendors. Please see the following advisory for details specific to pingback: 4tphi-sa-20070111-pingback. This advisory describes the results of the tests run against Community Server. Details: Community Server is vulnerable to the attacks described in the pingback advisory. Because of the license restrictions on this software, our testing was limited. However, it was found that at a minimum one could specify an arbitrary sourceURI in the pingback service call. It was also found that there were no limitations on the Content-Type or size of the sourceURI. In all tests, the server attempted to fetch large binary data from all provided URIs. A malicious user could abuse this service by sending multiple requests where the sourceURI resolved to a large file on a variety of servers. This can create a DoS scenario by either utilizing all available bandwidth or by causing the server to allocate all available threads to service requests. In testing it was found that both scenarios could be produced. Also see 4tphi-sa-20070111-wordpress for tests run. Recommendations: In order to prevent overly large files from being retrieved, a reasonable timeout for the request for the sourceURI should be set. Also, if content is missing a compatible Content-Type (such as text/xml) it should not be read as it can not be parsed. There are some more significant design problems, particularly with respect to pingback authentication. These are described in the pingback advisory and are not addressed here, as there has been no formal specification modification yet. Disclosure Timeline: 01-24-2007 - Released 01-16-2007 - Ticket closed by Telligent, no response. 01-15-2007 - Received automated reply for Telligent Support 01-14-2007 - Notified support (at) telligent (dot) com [email concealed] References: 4tphi-sa-20070111-pingback - Weaknesses in pingback design LEGAL NOTICES This advisory is being provided to you under the RFPolicy documented at http://www.wiretrip.net/rfp/policy.html. You are encouraged to read this policy; however, in the interim, you have approximately 5 days to respond to this initial email. -- Blake Matheny bmatheny (at) mobocracy (dot) net [email concealed] http://mobocracy.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFt7Ek+1RMaZNdlgURAmePAJ9tRUdY9Cf41jF7N0fdBiMiLzqKCgCdHa6i gGdON67iLaoW3+qDHvZXfPg= =7tiH -----END PGP SIGNATURE-----