full-disclosure - [DoS] - Real-debrid.fr Torrent2ddl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAAnqS-Jqdw=wfWmP7ypJV54hJgZyZpYPa36KV9tXkaF_z=5Bhw@mail.gmail.com>
Date: Fri, 21 Jun 2013 12:26:38 +0200
From: Xpo Xpo <smashxpo@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: [DoS] - Real-debrid.fr Torrent2ddl

Real-debrid's a "popular" french website offering a debrid service for a
lot of online hosting services, almost one hundred...

It also proposes another service https://real-debrid.fr/torrents allowing
you to upload torrent contents to a ddl hosting service (like Uptobox,
Mega, ...), only available for customers who paid.

Problem is that If you add a torrent (file or magnet) with an adequate size
of torrent contents (1,7TB is doing at least the trick), you're able to
handle a Denial of Service on the whole torrent2ddl service and crash all
the torrents processed at the time for all the customers.

The vulnerability is due to a very poor design of the service where the
whole size of the torrent contents isn't even checked at all by the
script(s) processing them, maybe also here by the lack of using an
extensible cloud service instead of normal servers.

The vendor was contacted, I don't know exactly if the vulnerability was
fixed since he banned manually the account used to discover it and he
didn't want to unban it since, not even answering anymore on the "fake"
support or the forum.

By the way, I guess that other similar services could have also the same
kind of vulnerabilities.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/