XML DoS Attack

[prodigysml]

The Issue

A specially crafted XML file can be used to create a denial of service scenario within the openpsa admin portal.

Vulnerable Code

openpsa/lib/net/nemein/rss/handler/admin.php

Lines 93 to 94 in bf990b9

	$opml_parser = xml_parser_create();
	xml_parse_into_struct($opml_parser, $opml_data, $opml_values);

The above code displays that an XML file is being parsed.

openpsa/lib/net/nemein/rss/handler/admin.php

Lines 85 to 87 in bf990b9

	if ( array_key_exists('net_nemein_rss_manage_opml', $_FILES)
	&& is_uploaded_file($_FILES['net_nemein_rss_manage_opml']['tmp_name'])) {
	$opml_file = $_FILES['net_nemein_rss_manage_opml']['tmp_name'];

The code above displays that the XML file is user controlled. This can allow an attacker to create a denial of service scenario for all versions of PHP prior to 5.6.21

Minimum PHP requirements for openpsa project:
http://www.openpsa2.org/resources/installing-openpsa/

CVE for vulnerable PHP function:
https://www.cvedetails.com/cve/CVE-2016-4539/