CVE-2020-35579
📋 TL;DR
This vulnerability in tindy2013 subconverter allows attackers to create a denial of service condition by exploiting a request loop in the /sub API endpoint. An attacker can craft a malicious URL that redirects back to the same endpoint, causing infinite recursion and resource exhaustion. This affects anyone running subconverter 0.6.4 with the vulnerable API endpoint exposed.
💻 Affected Systems
- tindy2013 subconverter
📦 What is this software?
Subconverter by Subconverter Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion (CPU, memory, network) from infinite request loops, potentially affecting other services on the same host.
Likely Case
Service degradation or temporary unavailability until the loop is manually stopped or resources are exhausted.
If Mitigated
Minimal impact if proper network segmentation and rate limiting are implemented.
🎯 Exploit Status
The exploit is simple to craft - just a URL that redirects to the vulnerable endpoint. Public discussion exists in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.7.0 or later
Vendor Advisory: https://github.com/tindy2013/subconverter/issues/284
Restart Required: Yes
Instructions:
1. Stop subconverter service. 2. Update to version 0.7.0 or later from GitHub releases. 3. Restart subconverter service.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to the /sub API endpoint using firewall rules or reverse proxy configuration.
iptables -A INPUT -p tcp --dport [subconverter-port] -s [trusted-networks] -j ACCEPT
iptables -A INPUT -p tcp --dport [subconverter-port] -j DROP
Rate Limiting
allImplement rate limiting on the /sub endpoint to prevent request loops from consuming all resources.
nginx: limit_req_zone $binary_remote_addr zone=subconverter:10m rate=10r/s;
apache: SetEnvIf Request_URI "^/sub" RATELIMIT=1
🧯 If You Can't Patch
- Disable or restrict access to the /sub API endpoint entirely
- Implement strict input validation to reject URLs containing the vulnerable endpoint's address
🔍 How to Verify
Check if Vulnerable:
Check if running version 0.6.4 and if /sub endpoint is accessible. Test with curl: curl -v 'http://[host]:[port]/sub?target=clash&url=http://localhost:[port]/sub&config='Check Version:
./subconverter --version or check the web interfaceVerify Fix Applied:
Verify version is 0.7.0 or later and test the same curl command - should not cause infinite loops.📡 Detection & Monitoring
Log Indicators:
- Rapid repeated requests to /sub endpoint
- High CPU/memory usage patterns
- Error logs showing redirect loops
Network Indicators:
- Unusual traffic patterns with recursive redirects
- High volume of requests to single endpoint
SIEM Query:
source="subconverter.log" AND "GET /sub" | stats count by src_ip | where count > 100