Uploaded image for project: 'PUBLIC - Liferay Portal Community Edition'
  1. PUBLIC - Liferay Portal Community Edition
  2. LPS-63459

DoS using DDM Form validation and DDMFormEvaluatorServlet

    Details

      Description

      Any user with permissions to create DDM form with validation can make portal unavailable.

      The same can be reproduced using DDMFormEvaluatorServlet for any user.

      Probable cause: DDMExpressionImpl use MathContext.UNLIMITED to parse incoming data.

      Steps to reproduce
      1, Download, compile and run attached DDMFormEvaluatorDoS.java
      2, Go to http://localhost:8080

      Expected result: Portal still works
      Actual result: Portal is not responsive


      CVSS Base Score: 7.8
      CVSS Temporal Score: 6.7
      CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:C/E:F/RL:U/RC:UC)
      

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              harry.chai Harry Chai
              Reporter:
              tomas.polesovsky Tomáš Polešovský
              Participants of an Issue:
              Recent user:
              Esther Sanz
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Days since last comment:
                4 years, 37 weeks, 1 day ago

                  Packages

                  Version Package
                  7.0.0 Beta 8