Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
Apache Geronimo 2.2.1 and earlier are vulnerable to a denial-of-service (DoS) attack. Attackers can exploit a flaw in how the application handles form parameters, causing excessive CPU consumption and rendering the server unresponsive. This vulnerability allows for a simple, yet effective, attack that can disrupt critical services.
Step 1: Target Identification: The attacker identifies a vulnerable Apache Geronimo server (version 2.2.1 or earlier).
Step 2: Payload Creation: The attacker crafts a malicious HTTP POST request. This request includes a large number of form parameters.
Step 3: Parameter Crafting: The attacker carefully crafts the form parameter names to ensure they all hash to the same value within the Geronimo server's hash table. This is achieved by understanding the hash function used and creating collisions.
Step 4: Request Submission: The attacker sends the crafted HTTP POST request to the vulnerable Geronimo server.
Step 5: Hash Collision Trigger: The Geronimo server receives the request and begins processing the form parameters. Due to the crafted parameters, the hash function generates numerous collisions.
Step 6: Resource Exhaustion: The server spends an excessive amount of CPU time resolving the hash collisions, leading to high CPU utilization.
Step 7: Denial of Service: The server becomes unresponsive or significantly degraded in performance, effectively causing a denial of service.
The vulnerability lies in the use of a weak hash function (likely a hash function without collision resistance) for processing form parameters. The application computes hash values for form parameters without proper collision protection. An attacker can craft a large number of parameters that all hash to the same value, leading to a worst-case scenario for hash table lookups. This results in a significant performance degradation as the server spends an excessive amount of time resolving these collisions, consuming CPU resources and leading to a DoS condition. The root cause is the lack of a mechanism to prevent hash collisions, allowing an attacker to control the hash table's performance.