[C#]: DOS through Decompression
am0o0 opened this issue · 5 comments
Query PR
Language
C#
CVE(s) ID list
- no CVE yet and definitely a CVE will be published soon.
CWE
No response
Report
Extracting Compressed files with any compression algorithm like gzip can cause to denial of service attacks. Attackers can compress a huge file which created by repeated similar byte and convert it to a small compressed file.
Added modeling for multiple CLI third parties.
In this pull request I've also added some valuable remote flow sources which I thought it is related to my query because mostly it need a file upload from Forms as a User Remote Source.
Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).
- Yes
- No
Blog post link
No response
@am0o0 how goes finding the CVE for this? If you do, please include the database as well
@Kwstubbs I forgot about this one, I checked this before in the past there were vulnerable instances but I forgot to continue reporting and submitting the vulnerabilities, I'll work on this week.
alright thanks
Your submission is now in status Closed.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed