Memory Exhaustion in Lookyloo via ZIP/HAR Decompression

Executive Summary

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture that expands to a very large size during processing. This could exhaust available memory, terminate processes, or make the Lookyloo instance unavailable, leading to a denial-of-service condition.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusually high memory usage or process crashes when processing ZIP, gzip, or zlib files in Lookyloo. Check logs for HTTP 400 responses indicating oversized compressed HAR submissions. Use system monitoring tools to detect repeated decompression attempts that may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to cause a persistent denial-of-service by repeatedly submitting oversized compressed files. This would make the Lookyloo instance unavailable until processes or the entire instance are restarted, disrupting normal operations.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability could lead to denial-of-service conditions, potentially disrupting services that handle sensitive data. This may impact compliance with GDPR (availability requirements) and HIPAA (accessibility of health data systems).

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch that enforces a 1 GB cumulative uncompressed-size limit for imported capture archives and size-limited gzip/zlib decompression for compressed HAR files. Update Lookyloo to the patched version to prevent memory exhaustion and denial-of-service conditions.

Useful 0 Not Useful 0