Chall-Manager Slow Loris Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Chall-Manager, a platform-agnostic system that initiates on-demand challenges for players. The issue arises in the HTTP Gateway, which processes headers without a set timeout. This lack of timeout can be exploited using a slow loris attack, causing a denial-of-service condition. The vulnerability affects Chall-Manager versions prior to 0.1.4 and does not require authentication or authorization to exploit. While it is recommended to deploy Chall-Manager deep within the infrastructure to prevent user access, the vulnerability still exists.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, causing the HTTP server to become unresponsive by overwhelming it with slow, deliberate requests that tie up resources.

Remediation

Users can upgrade to Chall-Manager version 0.1.4 or later to address this vulnerability.