DoS against Telligent Community Server

   Advisory: DoS against Telligent Community Server
Advisory ID: 4tphi-sa-20070111-communityserver

Release Date: 01-24-2007
Author: Blake Matheny ([email protected])

   Software: Community Server <= 2.1

     Impact: Remote DoS

Overview:

From Wikipedia, "Community Server is a community collaboration

platform that consists of a core blog, forums, photo gallery, and file
sharing system."

Several weaknesses have been found in the pingback specification

which has been implemented by Community Server as well as other vendors.
Please see the following advisory for details specific to pingback:
4tphi-sa-20070111-pingback. This advisory describes the results of the
tests run against Community Server.

Details:

Community Server is vulnerable to the attacks described in the

pingback advisory. Because of the license restrictions on this software,
our testing was limited. However, it was found that at a minimum one could
specify an arbitrary sourceURI in the pingback service call. It was also
found that there were no limitations on the Content-Type or size of the
sourceURI. In all tests, the server attempted to fetch large binary data
from all provided URIs. A malicious user could abuse this service by
sending multiple requests where the sourceURI resolved to a large file on
a variety of servers. This can create a DoS scenario by either utilizing
all available bandwidth or by causing the server to allocate all available
threads to service requests. In testing it was found that both scenarios
could be produced. Also see 4tphi-sa-20070111-wordpress for tests run.

Recommendations:

In order to prevent overly large files from being retrieved, a 

reasonable timeout for the request for the sourceURI should be set. Also,
if content is missing a compatible Content-Type (such as text/xml) it
should not be read as it can not be parsed. There are some more
significant design problems, particularly with respect to pingback
authentication. These are described in the pingback advisory and are not
addressed here, as there has been no formal specification modification
yet.

Disclosure Timeline:

01-24-2007 - Released
01-16-2007 - Ticket closed by Telligent, no response.
01-15-2007 - Received automated reply for Telligent Support
01-14-2007 - Notified [email protected]

References:

    4tphi-sa-20070111-pingback - Weaknesses in pingback design

LEGAL NOTICES

This advisory is being provided to you under the RFPolicy documented at
http://www.wiretrip.net/rfp/policy.html. You are encouraged to read this
policy; however, in the interim, you have approximately 5 days to respond
to this initial email.

–
Blake Matheny
[email protected]
http://mobocracy.net