SyncBreeze Denial-of-Service Vulnerability in Login Authentication Mechanism

A denial-of-service vulnerability has been identified in SyncBreeze version 15.2.24. The issue arises in the login authentication process, where attackers can send oversized password parameters with repeated 'password=' values. This overloads the login endpoint, potentially causing the service to crash and disrupt availability.

Impact

Exploitation of this vulnerability can lead to a crash of the SyncBreeze service, causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/login' endpoint with a 'password' parameter that includes an excessive number of 'password=' values. This can be done using a script or tool that automates the process of sending such a request, effectively overwhelming the login endpoint and causing the service to crash.