ebankIT 6 Denial Of Service – Torchsec
[Description]
An issue was discovered in ebankIT before version 7.
A Denial-of-Service attack is possible through the GET parameter
EStatementsIds located on the
/Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx endpoint.
The GET parameter accepts over 100 comma-separated e-statement IDs
without throwing an error. When this many IDs are supplied, the server
takes around 60 seconds to respond and successfully generate the
expected ZIP archive (during this time period, no other pages load). A
threat actor could issue a request to this endpoint with 100+ statement
IDs every 30 seconds, potentially resulting in an overload of the
server for all users.
------------------------------------------
[VulnerabilityType Other]
Denial of Service
------------------------------------------
[Vendor of Product]
ebankIT
------------------------------------------
[Affected Product Code Base]
ebankIT - Omnichannel Digital Banking Platform - Version 6, patched in version 7
------------------------------------------
[Affected Component]
The endpoint existing at /Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx?EStatementsIds=*id*,*id*,*id*,etc
------------------------------------------
[Attack Type]
Remote
------------------------------------------
[Impact Denial of Service]
true
------------------------------------------
[Attack Vectors]
I discovered it was possible to perform a Denial-of-Service attack on
the ebankIT platform, potentially resulting in a single user rendering
the entire application inaccessible. The vulnerable endpoint exists on
/Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx
and the EStatementsIds GET parameter accepts over 100
comma-separated e-statement IDs without throwing an error. When this
many IDs are supplied, the server takes around 60 seconds to respond
and successfully generate the expected zip file (during this 60
seconds, no other pages load). A threat actor could issue a request to
this endpoint with 100+ statement ID s every 30 seconds, potentially
resulting in overloading the server for all users of the ebankIT
platform. I believe this is being caused by a thread commitment issue
where there are no dedicated threads to individual processes.
------------------------------------------
[Discoverer]
Jake Murphy
Gloss