Re: DoS vulnerability?

Andreas Hartmann <[email protected]>
Newsgroups gmane.comp.cms.lenya.user
Message-ID <[email protected]>
Hi Wolfgang,

Am 01.03.10 14:20, schrieb Wolfgang Jeltsch:
> the root page of the Lenya 2.0.3 servlet lets you create new publications
> without requiring any authentication. Doesn’t this mean that an attacker could
> cause a denial of service by repeatedly creating publications?

your site should not make this page accessible to the public. Usually 
only the pages in <pub>/live are accessible without authentication. 
Since the "New publication" page is not in a publication and therefore 
cannot be protected using the standard Lenya authentication and 
authorization mechanisms, you should protect it using digest auth or a 
similar mechanism. Beware that the usecase can also be called from other 
URIs.

BTW, I don't see a specific relation between the "new publication" 
usecase and a DoS. If an attacker really wants to kill a dynamic 
non-protected Lenya site, there are various ways to achieve this (e.g. 
create lots of sessions/continuations to cause an OOME). A 
non-distributed DoS can certainly be handled by IP blacklisting, if 
you're facing a DDoS you're in serious trouble. You could look into web 
application firewall tools to address those issues.

Best regards,
Andreas


-- 
Andreas Hartmann, CTO
BeCompany GmbH
http://www.becompany.ch
Tel.: +41 (0) 43 818 57 01
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.