1623009 - Long password denial of service in bugzilla.mozilla.org

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, task)

Description

[Adi Heco]

Description: Long password denial of service

By sending a very long password (1.000.000 characters) it's possible to cause a denial a service attack on the server. This may lead to the website becoming unavailable or unresponsive. Usually this problem is caused by a vulnerable password hashing implementation. When a long password is sent, the password hashing process will result in CPU and memory exhaustion. Vulnerable password input: Bugzilla_password
Tests performed:
password of 1000000 characters => 30 s
password of 100 characters => 0.682 s
password of 100000 characters => 2.685 s
password of 1100000 characters => 29.999 s
password of 500 characters => 0.65 s

Steps to reproduce:
Intercept login request e.g. with Burp. Send intercepted request to repeater and increase number of characters in Bugzilla_password param, or send intercepted request to intruder, set payload Character block, setup numbers of chars min & max and monitor responses.

Comment 1

[Adi Heco]

Attachment: bugzilla_password_param.jpg

Comment 2

[David Lawrence [:dkl]]

for this we could impose a maximum password size. I would say around 4096 characters would be a good max. That is above what other sites set as a limit.

simon, any issues with doing this?

Comment 3

[Simon Bennetts [:psiinon]]

No, that sounds a reasonable limit.

Comment 4

[David Lawrence [:dkl]]

Attachment: 1623009_1.patch

Comment 5

[:glob ✱]

Comment on attachment 9142792 [details] [diff] [review]
1623009_1.patch

Review of attachment 9142792 [details] [diff] [review]:
-----------------------------------------------------------------

r=glob

Comment 6

[David Lawrence [:dkl]]

Merged to master. Releasing today. Opening bug.

Comment 7

[Adi Heco]

Hi,
hope you are all fine ...

After all, bounty && hof ?

Best regards

Comment 8

[Simon Bennetts [:psiinon]]

The sec-bounty? flag means that this bug will be reviewed by the Bug Bounty Committee when it next meets, which is usually weekly.

Comment 9

[Adi Heco]

Thank you Simon.

Hope see you soon on next bug :)
Best regards.

Comment 10

[Daniel Veditz [:dveditz]]

This appears to slow down your own query, but it's not a Denial of Service attack on the server or other users. Does not qualify for a bounty or the Hall of Fame.