SyncBreeze Denial-of-Service Vulnerability in Login Endpoint

A denial-of-service vulnerability has been identified in SyncBreeze version 10.0.28. The issue resides in the login endpoint, where remote attackers can send oversized payloads in the login request. This action overwhelms the application, causing it to crash and disrupt service availability.

Impact

Exploitation of this vulnerability leads to a crash of the SyncBreeze service, causing a disruption in file synchronization operations.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/login' endpoint with an oversized payload in the 'username' or 'password' fields. This can be done using a network socket connection.