HashDOS and ColdFusion
Earlier this week at the 28C3 security conference in Berlin researchers presented on a denial of service (DOS) technique that several web application platforms (PHP, ASP.NET, Node.js, Tomcat, Java's HashMap/Hashtable etc) are vulnerable to, known as
The exploit takes advantage of hash collisions in the internal implementation of hashtables / hashmaps (think CFML
struct). When two keys are hashed and result in the same hash code a collision occurrs, and additional processing must take place to store or retrieve the item. Most application servers store request input variable (eg form, url scopes) in such a data structure. If you can construct a request with variable names that all have the same internal hashcode, the request goes from taking less than a second to process to several minutes.
As you can imagine this can cause a server to crawl/crash pretty quickly with a relatively small payload. Microsoft has released an out of band security patch for ASP.NET already. Tomcat has provided a work around in versions 7.0.23 or 6.0.35 and up.
The typical patch / workaround for this issue is to limit the number of input request variables, ASP.NET defaults this limit to 1000, tomcat defaults to 10,000.
Update: - Adobe has released a security hotfix to address this issue on ColdFusion 8 and 9. If you are running CF 6 or 7 you may still be vulnerable to this but Adobe no longer produces security hotfixes for these versions (upgrade to CF 8 or above).
Like this? Follow me ↯Tweet Follow @pfreitag
You might also like:
- J2EE Sessions in CF10 Uses Secure Cookies - April 5, 2013
- Understanding HashDos and postParameterLimit - August 1, 2012
- Using AntiSamy with ColdFusion - August 5, 2010
- Tuning Tomcat IIS Connectors worker.properties and server.xml - August 12, 2019
- Fixinator and Foundeo Security Bundle - May 14, 2019
- Updating Java on ColdFusion or Lucee - March 21, 2019
- Tomcat Java 10 on Windows CreateJavaVM Failed - September 13, 2018
- Java Unlimited Strength Crypto Policy for Java 9 or 1.8.0_151 - October 19, 2017