Xorux LPAR2RRD Read-Only User Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Xorux LPAR2RRD versions through 8.04, running on Rocky Linux 8.10. The issue allows an authenticated, read-only user to terminate any processes on the Xormon Original virtual appliance as the lpar2rrd user. Exploitation of this vulnerability can disrupt services by stopping the web server, the xormon.war web application, or the lpar2rrd-daemon process.

Impact

Exploitation of this vulnerability creates a denial-of-service condition by terminating critical processes, which can disrupt service availability on the affected virtual appliance.

Reproduction

To reproduce this vulnerability, an authenticated, read-only user can send a request to the 'reporter.sh' endpoint with a 'stop' command parameter specifying the process ID (PID) of a running process. The request must include basic authentication. Once the request is processed, the specified PID will be terminated, causing a denial-of-service condition by stopping the associated service or application.

Remediation

Users are advised to upgrade to Xorux LPAR2RRD version 8.05, which addresses this vulnerability.