Resource consumption Vulnerability

Hello everyone,
Today, I will talk about a vulnerability I discovered in a American University website. In summary, it is an Resource consumption

About Me:
My name is Ramzey Elsayed Mohamed , and I am a cybersecurity professional specializing in penetration testing, bug hunting, and vulnerability research. I have extensive experience in identifying and reporting security flaws to enhance the safety of digital platforms. ِAnd my nickname is @VulnRAM

##About a Resource consumption Vulnerability##

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary’s influence is “asymmetric.”This can lead to poor performance due to “amplification” of resource consumption, typically in a non-linear fashion. This situation is worsened if the product allows malicious users or attackers to consume more resources than their access level permits.

## Impact (High)##

Technical Impact: DoS: Amplification; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)

##I know you don’t understand now, so this is a summary of what happens in the Vulnerability##

All that happens is that the system, which in our case is the web server, enters a never-ending loop, which causes the server’s resources to be consumed.

First, As usual, the root cause of every vulnerability is that the programmer trusts user input. Therefore, the places to look for this vulnerability are in the search box or the login page, like to XSS and SQL injection.

Okay, I found the vulnerability in the search box.

##so How I Found the##

While I was browsing the site I tried the search box to try XSS But I didn’t find anything.

So I ran a tool, Wapiti3 — it is a web scanning tool.
And while it was scanning, it informed me that there is a suspicion of a Resource Consumption Vulnerability.

So I tried searching for anything first to make sure the search process works correctly.

search process works correctly.

However, when I input the following XXE (XML External Entity Injection) payload into the search box:

The search process did not terminate — the request kept loading without returning a result.

As you can see, he enters into a cycle of searching without ending….!!!

Therefore, the requested task does not terminate, which leads to resource consumption, such as CPU and RAM.

So, imagine you run Burp Suite and send this search request to the Intruder — what do you expect will happen?

Yes, this is exactly what will happen Server Crash

My Facebook account :

https://www.facebook.com/profile.php?id=100035076459679

My linkedin :

https://www.linkedin.com/in/ramzey-elsayed-mohamed-1a2126246/