DirectAdmin up to 1.50.1 username/password denial of service

Summaryinfo

A vulnerability described as problematic has been identified in DirectAdmin up to 1.50.1. Impacted is an unknown function. The manipulation of the argument username/password results in denial of service. It is possible to launch the attack remotely. Furthermore, an exploit is available. Applying restrictive firewalling is recommended.

Detailsinfo

A vulnerability was found in DirectAdmin up to 1.50.1. It has been classified as problematic. Affected is an unknown code block. The manipulation of the argument username/password with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability.

The weakness was published 01/08/2017 by Amir with IeDb ir as EDB-ID 40996 as not defined exploit (Exploit-DB). The advisory is shared for download at exploit-db.com. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1499. The advisory points out:

An attacker can send a username and password in the login screen DirectAdmin long,DirectAdmin to disrupt And Crach. This problem is present in all versions of DirectAdmin. There is no limit on the number of characters entered.

A public exploit has been developed by Amir in URL and been published immediately after the advisory. The exploit is shared for download at exploit-db.com. It is declared as functional. The code used by the exploit is:

POST /CMD_LOGIN HTTP/1.1
 
referer=%2F&username=$POC&password=$POC
 
$POC = A * 10000

It is possible to mitigate the weakness by firewalling .

The vulnerability is also documented in the vulnerability database at Exploit-DB (40996). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• DirectAdmin

Version

• 1.50.0
• 1.50.1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion