Unauthenticated Resource Exhaustion in TBEA TLogger V2.1.0.0

Executive Summary

TBEA TLogger V2.1.0.0B0.0.0.0 has an unauthenticated resource exhaustion vulnerability in its web server. An attacker can send PUT requests to the /tmp/ endpoint, causing the server to create persistent files with attacker-controlled data under /opt/myapp/webserver/. The files are not removed because the server tries to move them to a non-existent directory. Repeated requests can fill up storage and cause a denial-of-service.

Useful 0 Not Useful 0

Detection Guidance

Check for unusual PUT requests to /tmp/ endpoint. Monitor storage usage under /opt/myapp/webserver/. Look for persistent files created by the web server that are not removed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to exhaust system storage by repeatedly creating files. This can lead to denial-of-service, making the device or application unavailable. It may also allow attackers to store malicious data on the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to storage exhaustion, potentially causing system unavailability. For GDPR, this may violate Article 32 (security of processing) due to lack of availability. For HIPAA, it could impact integrity and availability of protected health information under the Security Rule.

Useful 0 Not Useful 0

Mitigation Strategies

Block PUT requests to /tmp/ endpoint at the firewall or web server level. Implement rate limiting for PUT requests. Ensure the target directory /opt/myapp/webserver/ exists to prevent file accumulation.

Useful 0 Not Useful 0