Executive Summary

A vulnerability in the webserver of UnrealIRCd 6.0.5 through 6.2.6 allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers. This vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. It is not actively exploited at the time of reporting.

Technical Analysis

The vulnerability is caused by the webserver in UnrealIRCd not limiting the number of HTTP request headers. This allows remote attackers to cause a denial of service via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default). The vulnerability is classified as a denial of service (DoS) vulnerability.

How It Gets Exploited

An unauthenticated remote attacker on the same network can send an HTTP request with an unlimited number of headers to the vulnerable UnrealIRCd webserver. If a websocket or JSON-RPC listener is enabled, the server will consume increasing amounts of memory, leading to a denial of service. The attacker does not need any privileges or specific user interaction to trigger this vulnerability.

Impact Assessment

The vulnerability affects UnrealIRCd versions 6.0.5 through 6.2.6. An attacker can achieve a denial of service, causing the server to become unresponsive. The CVSS score of 7.5 indicates a high severity vulnerability. The vulnerability has a high impact on availability, but no impact on confidentiality or integrity.

Recommended Actions

To mitigate this vulnerability, administrators should update UnrealIRCd to version 6.2.7 or later. Additionally, administrators should ensure that websocket or JSON-RPC listeners are disabled if not required. Implementing a network segmentation or a web application firewall (WAF) rule to limit the number of HTTP request headers can also help prevent exploitation.

Sources

  • National Vulnerability Database (NVD)
  • UnrealIRCd forums
  • UnrealIRCd official website