HexBrain

Nextcloud · Report #1806223

Reference fetch can saturate the server bandwidth for 10 seconds

Validstatus
mediumseverity
4upvotes
29 Apr 2023disclosed

Summary

SA: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9wmj-gp8v-477j

How it was found

Summary:

When posting a message on talk, a reference is fetched for any link in the message There is a hardcoded mandatory 10sec timeout. But the ressource is still fetched for those entire 10 seconds.

For high-bandwidth servers, this can result in disk space being temporarily filled and saturate the server bandwidth. Tested on my 2.5gbps network, I was easily able to find 10GB ressources online that have higher network speed and fully saturate the netwrok for a few seconds and a few messages.

Steps To Reproduce:

  1. Open a talk room
  2. Post multiple messages containing a link to a high availability ressource like https://speed.hetzner.de/10GB.bin

Impact

Can severly impact server performances and/or lead to a denial of service

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original