Axigen Server Denial of Service Vulnerability via Nested SOAP / JSON Requests (CVE-Pending)

A denial of service vulnerability in the Axigen HTTP services allows an unauthenticated remote attacker to crash the Axigen server process with a single small request. The crash interrupts all services hosted by the affected process (SMTP, IMAP, POP3, WebMail, WebAdmin) until the process is restarted automatically, and repeating the request can keep the server unavailable.

Details

Affected versions: 
Axigen 10.x up to 10.5.68; fixed starting with 10.5.69 
Axigen 10.6.x up to 10.6.39; fixed starting with 10.6.40 
Axigen 10.7.0 and 10.7.1; fixed starting with 10.7.2

Vulnerability type: Denial of Service (uncontrolled recursion)

Affected component(s): Axigen WebMail, Axigen WebAdmin, Axigen WebMail Proxy (HTTP request body parsing)

Prerequisites: Network access to a WebMail or WebAdmin listener. No authentication or account on the target server is required.

Description:

The Axigen HTTP services parse SOAP / XML and JSON request bodies before the request is routed and authenticated, and the nesting depth of these bodies was not bounded. A request body with a very large number of nested XML elements or JSON objects exhausts the stack of the thread processing the request, which terminates the server process with a segmentation fault.

The request does not need to target an existing resource and can be sent to any path served by the WebMail or WebAdmin listeners. The WebMail Proxy service used in clustered setups is affected by the JSON variant starting with 10.6.

The problem was addressed by enforcing a maximum nesting depth when parsing SOAP / XML and JSON request bodies.

Reported by: Dmitri Kaslov & rootkiTED