DietPi-Dashboard up to 0.6.1 TCP Connection resource pool

Summaryinfo

A vulnerability was found in DietPi-Dashboard up to 0.6.1 and classified as critical. This impacts an unknown function of the component TCP Connection Handler. The manipulation results in resource pool. This vulnerability is identified as CVE-2023-38505. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in DietPi-Dashboard up to 0.6.1 (Forum Software). Affected is an unknown code of the component TCP Connection Handler. The manipulation with an unknown input leads to a resource pool vulnerability. CWE is classifying the issue as CWE-410. The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources. This is going to have an impact on availability. CVE summarizes:

DietPi-Dashboard is a web dashboard for the operating system DietPi. The dashboard only allows for one TLS handshake to be in process at a given moment. Once a TCP connection is established in HTTPS mode, it will assume that it should be waiting for a handshake, and will stay this way indefinitely until a handshake starts or some error occurs. In version 0.6.1, this can be exploited by simply not starting the handshake, preventing any other TLS handshakes from getting through. An attacker can lock the dashboard in a state where it is waiting for a TLS handshake from the attacker, who won't provide it. This prevents any legitimate traffic from getting to the dashboard, and can last indefinitely. Version 0.6.2 has a patch for this issue. As a workaround, do not use HTTPS mode on the open internet where anyone can connect. Instead, put a reverse proxy in front of the dashboard, and have it handle any HTTPS connections.

The weakness was released 07/27/2023 as GHSA-3jr4-9rxf-fr44. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2023-38505 since 07/18/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 0.6.2 eliminates this vulnerability. Applying the patch 79cd78615d28f577454415e4baafe4dcd9d09666 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Forum Software

Name

• DietPi-Dashboard

Version

• 0.6.0
• 0.6.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion