CVE-2020-28873
📋 TL;DR
FluxBB 1.5.11 is vulnerable to denial of service (DoS) attacks through the login form. Attackers can send extremely long passwords that cause CPU and memory exhaustion during password hashing, potentially crashing the server. This affects all FluxBB 1.5.11 installations with default configurations.
💻 Affected Systems
- FluxBB
📦 What is this software?
Fluxbb by Fluxbb
⚠️ Risk & Real-World Impact
Worst Case
Complete server unavailability due to resource exhaustion, affecting all users and potentially requiring server restart.
Likely Case
Temporary service degradation or server crashes during attack periods, disrupting forum availability.
If Mitigated
Minimal impact with proper input validation and resource limits in place.
🎯 Exploit Status
Exploitation requires only sending HTTP POST requests with long password values to the login endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.12 or later
Vendor Advisory: http://fluxbb.com
Restart Required: No
Instructions:
1. Backup your FluxBB installation and database. 2. Download FluxBB 1.5.12 or later from the official website. 3. Replace all files except config.php and avatars directory. 4. Run any database update scripts if provided. 5. Verify the installation works correctly.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rule
allBlock HTTP requests with excessively long password parameters
Add WAF rule to limit POST parameter length for password field
Rate Limiting
allImplement rate limiting on login attempts to prevent repeated attacks
Configure web server or application rate limiting for /login.php endpoint
🧯 If You Can't Patch
- Implement input validation to reject passwords exceeding reasonable length (e.g., 256 characters)
- Deploy a reverse proxy or WAF to filter malicious requests before they reach the application
🔍 How to Verify
Check if Vulnerable:
Check if FluxBB version is 1.5.11 by examining the footer or version.php fileCheck Version:
grep -r "define('FORUM_VERSION'" /path/to/fluxbb/ || cat /path/to/fluxbb/version.phpVerify Fix Applied:
Verify version is 1.5.12 or later and test with long password input (should be rejected or handled efficiently)📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts with unusually long password fields
- High CPU/memory usage spikes coinciding with login requests
Network Indicators:
- HTTP POST requests to login.php with password parameter exceeding normal length
SIEM Query:
source="web_logs" AND uri="/login.php" AND password_length>1000🔗 References
- http://fluxbb.com
- https://www.acunetix.com/vulnerabilities/web/long-password-denial-of-service/#:~:text=By%20sending%20a%20very%20long%2Ca%20vulnerable%20password%20hashing%20implementation
- http://fluxbb.com
- https://www.acunetix.com/vulnerabilities/web/long-password-denial-of-service/#:~:text=By%20sending%20a%20very%20long%2Ca%20vulnerable%20password%20hashing%20implementation
