CVE-2020-13935 - WebSocket Frame Payload Length Validation Denial of Service

[princechaddha]

Is there an existing template for this?

• I have searched the existing templates.

Template requests

Title: CVE-2020-13935 - WebSocket Frame Payload Length Validation Denial of Service

Description:
Apache Tomcat versions 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, and 7.0.27 to 7.0.104 contain a vulnerability in the WebSocket module where the payload length of WebSocket frames is not correctly validated. This can lead to an infinite loop when processing frames with invalid payload lengths. Attackers can exploit this flaw by sending multiple malicious requests, resulting in a denial of service (DoS) on the affected Tomcat instance.

Severity:
High (CVSS: 7.5, Vector: [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H])

POC:

• https://github.com/RedTeamPentesting/CVE-2020-13935
• https://github.com/aabbcc19191/CVE-2020-13935

References:

• OpenSUSE Security Announcement 1
• OpenSUSE Security Announcement 2
• McAfee Advisory
• Apache Users Thread
• NetApp Advisory

Shodan Query:
html:"Apache Tomcat"

CPE:
cpe:2.3:a:apache:tomcat::::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone1:::::::*
cpe:2.3:a:apache:tomcat:10.0.0:milestone1:::::::*

Anything else?

No response

[princechaddha]

/bounty $50

[algora-pbc]

💎 $50 bounty • ProjectDiscovery Bounty Available for CVE Template Contribution

Steps to Contribute:

• Claim attempt: Comment /attempt #11019 on this issue to claim attempt.
• Write the Template: Create a high-quality Nuclei template for the specified CVE, following our Contribution Guidelines and Acceptance Criteria.
• Submit the Template: Open a pull request (PR) to projectdiscovery/nuclei-templates and include /claim #11019 in the PR body to claim the bounty.
• Receive Payment: Upon successful merge of your PR, you will receive 100% of the bounty through Algora.io within 2-5 days. Ensure you are eligible for payouts.

Thank you for contributing to projectdiscovery/nuclei-templates and helping us democratize security!

Acceptance Criteria: The template must include a complete POC and should not rely solely on version-based detection. Contributors are required to provide debug data(-debug) along with the template to help the triage team with validation. Rewards will only be given once the template is fully validated by the team. Templates that are incomplete or invalid will not be accepted. Avoid adding code templates for CVEs that can be achieved using HTTP, TCP, or JavaScript. Such templates are blocked by default and won’t produce results, so we prioritize creating templates with other protocols unless exceptions are made.
You can check the FAQ for the Nuclei Templates Community Rewards Program here.

Add a bounty • Share on socials

Attempt	Started (GMT+0)	Solution
🔴 @m4lwhere	Oct 21, 2024, 6:19:06 PM	WIP
🔴 @sachinks07	Oct 29, 2024, 7:10:32 PM	WIP
🟢 @sttlr	Nov 7, 2024, 8:27:27 AM	#11164
🔴 @Harsh9485	Nov 7, 2024, 12:15:31 PM	WIP

[m4lwhere]

/attempt #11019

Options

• Cancel my attempt

[algora-pbc]

@m4lwhere: Reminder that in 4 days the bounty will become up for grabs, so please submit a pull request before then 🙏

[algora-pbc]

The bounty is up for grabs! Everyone is welcome to /attempt #11019 🙌

[sachinks07]

/attempt #11019

Options

• Cancel my attempt

[algora-pbc]

@sachinks07: Reminder that in 4 days the bounty will become up for grabs, so please submit a pull request before then 🙏

[algora-pbc]

The bounty is up for grabs! Everyone is welcome to /attempt #11019 🙌

[sttlr]

/attempt #11019

Algora profile	Completed bounties	Tech	Active attempts	Options
@sttlr	2 projectdiscovery bounties	JavaScript, Go, Shell & more		Cancel attempt

[Harsh9485]

/attempt #11002

Options

• Cancel my attempt

[algora-pbc]

Note

The user @sttlr is already attempting to complete issue #11019 and claim the bounty. We recommend checking in on @sttlr's progress, and potentially collaborating, before starting a new solution.

[algora-pbc]

💡 @sttlr submitted a pull request that claims the bounty. You can visit your bounty board to reward.