Multiple vulnerabilities in Rdiffweb

Published: 2022-10-04

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-3371 CVE-2022-3364
CWE-ID	CWE-770
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available.
Vulnerable software	Rdiffweb Web applications / Other software
Vendor	Patrik Dufresne

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Allocation of Resources Without Limits or Throttling

EUVDB-ID: #VU67902

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-3371

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to allocation of resources without limits or throttling in the Token name parameter. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Rdiffweb: before 2.5.0a3

CPE2.3

cpe:2.3:a:ikus060:rdiffweb:*:*:*:*:*:*:*:

External links

http://huntr.dev/bounties/4e8f6136-50c7-4fa1-ac98-699bcb7b35ce
http://github.com/ikus060/rdiffweb/commit/b62c479ff6979563c7c23e7182942bc4f460a2c7

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Allocation of Resources Without Limits or Throttling

EUVDB-ID: #VU67903