Hyperlpr Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Hyperlpr version 3.0. The issue arises because the server does not properly manage excessive characters added to the end of multipart boundaries, regardless of the type of character used. This flaw can be exploited by sending malformed multipart requests with arbitrary characters appended to the boundary, leading to excessive resource consumption and a complete denial of service for all users. The vulnerability can be exploited without authentication, meaning no user login or interaction is required.

Impact

Exploitation of this vulnerability causes significant resource exhaustion, leading to a complete denial of service where legitimate users are unable to interact with the service.

Reproduction

The vulnerability can be reproduced by sending a multipart request to the server's API endpoint with an excessive number of characters appended to the end of the multipart boundary. This can be done using a script that automates the process, such as one written in Python that uses the requests library to send the malformed request. The server will then enter an infinite loop processing the extra characters, causing it to become unresponsive.