Vulnerabilities > CVE-2018-16789 - Infinite Loop vulnerability in Shellinabox Project Shellinabox

Summary

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop, exhausting available CPU resources and taking the service down.

Vulnerable Configurations

Common Weakness Enumeration (CWE)

• CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Packetstorm

References