Miggo Logo

CVE-2020-35210: A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages.

6.5

CVSS Score
3.1

Basic Information

EPSS Score
0.53515%
Published
12/17/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
io.atomix:atomixmaven<= 3.1.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper handling of Raft OpenSessionRequest messages. Based on:

  1. The CWE-400 classification indicates uncontrolled resource consumption
  2. The attack pattern involves flooding session requests
  3. Standard Raft implementation patterns suggest session management components would handle these requests
  4. The 'OpenSessionRequest' specificity in the advisory points directly to session creation functions
  5. Atomix architecture typically locates Raft protocol handling in raft module classes While exact code isn't available, these functions represent the most logical entry points for session management in a Raft implementation, and their lack of rate limiting would directly enable the described DoS attack.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility in *tomix v*.*.* *llows *tt**k*rs to **us* * **ni*l o* s*rvi** (*oS) vi* * R**t s*ssion *loo*in* *tt**k usin* R**t Op*nS*ssionR*qu*st m*ss***s.

Reasoning

T** vuln*r**ility st*ms *rom improp*r **n*lin* o* R**t Op*nS*ssionR*qu*st m*ss***s. **s** on: *. T** *W*-*** *l*ssi*i**tion in*i**t*s un*ontroll** r*sour** *onsumption *. T** *tt**k p*tt*rn involv*s *loo*in* s*ssion r*qu*sts *. St*n**r* R**t impl*m*n