DoS/OOM leak vulnerability in Apache Mina SSHD Server

Vulnerability

A vulnerability exists in the sshd-core module of Apache Mina SSHD, specifically in the BufferedIoOutputStream class, where an unbounded amount of data can be written to the buffer without an upper limit [2]. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions up to and including 2.6.x [1][3]. The fix was introduced in version 2.7.0 [1][3]. The BufferedIoOutputStream does not impose a maximum data pending limit, allowing an attacker to write an arbitrary amount of data until the server runs out of memory [2].

Exploitation

An attacker needs network access to the vulnerable Mina SSHD server. No authentication is required because the vulnerability can be triggered during the unauthenticated phase of the SFTP or port forwarding session setup [1][3]. By sending a specially crafted sequence of data packets that exploit the unbounded buffering, the attacker can cause the server to accumulate large amounts of data in memory without blocking, leading to an OutOfMemory error [2][3]. This is a denial-of-service attack that does not require any user interaction or special privileges [1].

Impact

Successful exploitation results in denial of service due to an OutOfMemory error. The server becomes unresponsive or crashes, impacting the availability of the SFTP and port forwarding services [1][3]. The confidentiality and integrity of data are not directly affected, but the service disruption can lead to operational downtime [1].

Mitigation

Apache Mina SSHD version 2.7.0 addresses this issue by adding an upper bound to the data pending in the BufferedIoOutputStream, typically set to the maximum window size, blocking writes when the buffer is full to prevent memory exhaustion [2][3]. Users should upgrade to version 2.7.0 or later. There is no known workaround for unpatched versions [1][2][3].