CVE-2023-30455 [Description] An issue was discovered in ebankIT before version 7. A Denial-of-Service attack is possible through the GET parameter EStatementsIds located on the /Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx endpoint. The GET parameter accepts over 100 comma-separated e-statement IDs without throwing an error. When this many IDs are supplied, the server takes around 60 seconds to respond and successfully generate the expected ZIP archive (during this time period, no other pages load). A threat actor could issue a request to this endpoint with 100+ statement IDs every 30 seconds, potentially resulting in an overload of the server for all users. ------------------------------------------ [VulnerabilityType Other] Denial of Service ------------------------------------------ [Vendor of Product] ebankIT ------------------------------------------ [Affected Product Code Base] ebankIT - Omnichannel Digital Banking Platform - Version 6, patched in version 7 ------------------------------------------ [Affected Component] The endpoint existing at /Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx?EStatementsIds=*id*,*id*,*id*,etc ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Denial of Service] true ------------------------------------------ [Attack Vectors] I discovered it was possible to perform a Denial-of-Service attack on the ebankIT platform, potentially resulting in a single user rendering the entire application inaccessible. The vulnerable endpoint exists on /Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx and the EStatementsIds GET parameter accepts over 100 comma-separated e-statement IDs without throwing an error. When this many IDs are supplied, the server takes around 60 seconds to respond and successfully generate the expected zip file (during this 60 seconds, no other pages load). A threat actor could issue a request to this endpoint with 100+ statement ID s every 30 seconds, potentially resulting in overloading the server for all users of the ebankIT platform. I believe this is being caused by a thread commitment issue where there are no dedicated threads to individual processes. ------------------------------------------ [Discoverer] Jake Murphy