Item6784: DoS on bin/search with an asterisk wildcard using bookview

The following request:

curl -i 'http://www.twiki.org/cgi-bin/search/TWiki/?scope=topic&regex=on&bookview=on&search=%5C.*'

Will cause the bin/search cgi to eat the 100% the CPU of the server.

Tested on twiki 4.2.0 and also on 5.0.2

Also your own server (twiki.org) seems to be affected.

I saw googleboot making this kind of search on my server. I workarounded it with an apache rule that redirects any search with an asterisk to home.

RewriteCond %{QUERY_STRING} ^(.*)\*(.*)$
RewriteRule .*/cgi-bin/search/.* https://www.twiki.org/ [R,L]

I think that a CVE for this DoS is needed.

-- TWiki:Main/CarlosLopez - 2011-08-04

Thank you Carlos for reporting. Issue confirmed.

This is a severity 3 issue based on our security alert process, TWiki:Codev/TWikiSecurityAlertProcess - e.g. we handle this as a bug without a CVE.

-- TWiki:Main.PeterThoeny - 2011-08-04

The bookview takes a lot of CPU when there are many pages.

Fix: Limit the number of topics to 64 on a bookview.

-- TWiki:Main.PeterThoeny - 2011-08-04

This is now fixed in trunk and TWiki-5.0 branch.

-- TWiki:Main.PeterThoeny - 2011-08-04

Thanks Petter, I tested your patch and it solves the issue

-- TWiki:Main.CarlosLopez - 2011-08-05