CVE-2022-1926: Allocation of Resources Without Limits in in trudesk

Valid

Reported on

May 20th 2022

Steps to reproduce:

1. As an admin, start a new conversation with any member(normal user)
2. If the member(normal user) reply with a text of huge characters, (more than crores, etc)the admin may not able to access the dash board and its get started lagging, because the server get DOS

POC Screenshot:

[

POC Video:

https://www.mediafire.com/file/tzfqws14imvdfxr/trudesk_dos.mov/file

Patch recommendation:

1. Limit the characters to max (5000 or 10000)

Impact

1. Denial of service