CVE-2018-16789

🗓️ 17 Mar 2019 18:36:51Reported by mitreType

cve🔗 web.nvd.nist.gov👁 94 Views🌐 WEB

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a crafted multipart/form-data HTTP request, an attacker could exploit this to force shellinaboxd into an infinite loop

Reporter	Title	Published	Views	Family All 13
0day.today	Shell In A Box 2.2.0 Denial Of Service Exploit	28 Oct 201800:00	–	zdt
Circl	CVE-2018-16789	28 Oct 201819:04	–	circl
Cvelist	CVE-2018-16789	17 Mar 201918:36	–	cvelist
Debian CVE	CVE-2018-16789	17 Mar 201918:36	–	debiancve
EUVD	EUVD-2018-8589	7 Oct 202500:30	–	euvd
NVD	CVE-2018-16789	21 Mar 201916:00	–	nvd
OSV	DEBIAN-CVE-2018-16789	21 Mar 201916:00	–	osv
OSV	UBUNTU-CVE-2018-16789	21 Mar 201916:00	–	osv
Packet Storm	Shell In A Box 2.2.0 Denial Of Service	27 Oct 201800:00	–	packetstorm
Prion	Design/Logic Flaw	21 Mar 201916:00	–	prion

NVD

Node

shellinabox_project shellinaboxRange≤2.20

Source	Link
code	www.code.google.com/archive/p/shellinabox/issues
github	www.github.com/shellinabox/shellinabox/commit/4f0ecc31ac6f985e0dd3f5a52cbfc0e9251f6361
seclists	www.seclists.org/fulldisclosure/2018/Oct/50
packetstormsecurity	www.packetstormsecurity.com/files/149978/Shell-In-A-Box-2.2.0-Denial-Of-Service.html

Parameter	Position	Path	Description	CWE
boundary	request body	s/	Multipart/form-data parser can enter infinite loop on malformed payload, causing CPU exhaustion	CWE-835
payload	request body	s/	Multipart/form-data parser can enter infinite loop on malformed payload, causing CPU exhaustion	CWE-835

17 Jun 2026 01:44Current

7.3High risk

Vulners AI Score7.3

CVSS 37.5

CVSS 27.8

EPSS0.05986

CWE-835