e-SIC Livre 0.2.2 Resource Consumption

# CVE-2026-50787 — Uncontrolled Resource Consumption in e-SIC Livre
    
    ## Summary
    
    A resource consumption vulnerability exists in the CAPTCHA generation component of **e-SIC Livre (esiclivre)**.
    
    The vulnerable endpoint accepts user-controlled parameters that define CAPTCHA image dimensions, font size, and the number of characters to render. These values are used without appropriate bounds checking.
    
    An unauthenticated remote attacker can supply excessively large values, causing the application to consume significant memory and CPU resources during image creation and text rendering. This may result in application timeouts, HTTP 5xx responses, worker exhaustion, or denial of service.
    
    ## Affected Project
    
    * **Project:** e-SIC Livre
    * **Repository:** [https://github.com/esiclivre/esiclivre](https://github.com/esiclivre/esiclivre)
    * **Affected versions:** v0.2.2 and earlier
    * **Affected commit:** up to and including `0a72b4c9ab89244ec3bd3d7fa0b765850cc9afd7`
    * **Affected component:** `restrito/inc/captcha.php`
    
    ## Vulnerable Parameters
    
    The endpoint accepts the following GET parameters:
    
    * `l` - image width
    * `a` - image height
    * `tf` - font size
    * `ql` - number of CAPTCHA characters
    
    These parameters are obtained directly from user input and used in image-processing operations without appropriate upper bounds.
    
    ## Technical Details
    
    The vulnerable code reads values directly from `$_GET`:
    
    ```php
    $largura = $_GET["l"];
    $altura = $_GET["a"];
    $tamanho_fonte = $_GET["tf"];
    $quantidade_letras = $_GET["ql"];
    
    captcha($largura,$altura,$tamanho_fonte,$quantidade_letras);
    ```
    
    The supplied width and height are subsequently passed to the GD image creation function:
    
    ```php
    $imagem = imagecreate($largura,$altura);
    ```
    
    The user-controlled `ql` value also determines the number of iterations performed when rendering CAPTCHA characters:
    
    ```php
    for($i = 1; $i <= $quantidade_letras; $i++){
        imagettftext(
            $imagem,
            $tamanho_fonte,
            rand(-25,25),
            ($tamanho_fonte*$i),
            ($tamanho_fonte + 10),
            $branco,
            $fonte,
            substr($palavra,($i-1),1)
        );
    }
    ```
    
    Because these values are not constrained to reasonable limits, specially crafted requests can force the application to perform excessive image allocation and text-rendering operations.
    
    ## Attack Vector
    
    The vulnerable CAPTCHA endpoint is remotely accessible.
    
    An attacker can submit requests containing abnormally large values for the image dimensions, font size, or character count. The server then attempts to process those values using PHP GD operations.
    
    This can lead to:
    
    * excessive memory allocation;
    * excessive CPU consumption;
    * PHP worker exhaustion;
    * request timeouts;
    * HTTP 5xx responses;
    * temporary service unavailability.
    
    No authentication is required to reach the vulnerable functionality.
    
    ## Impact
    
    Successful exploitation can result in **Denial of Service (DoS)** through uncontrolled resource consumption.
    
    The impact depends on the PHP configuration, available system resources, web server configuration, and number of concurrent requests.
    
    ## Root Cause
    
    The vulnerability is caused by insufficient validation and lack of upper bounds on user-controlled parameters before they are passed to resource-intensive GD image operations.
    
    ## Recommended Remediation
    
    The application should strictly validate all CAPTCHA generation parameters before processing them.
    
    Recommended measures include:
    
    * convert all parameters to integers before use;
    * enforce strict minimum and maximum values;
    * reject values outside the expected range;
    * use fixed server-side CAPTCHA dimensions where possible;
    * limit the maximum number of rendered characters;
    * enforce reasonable PHP memory and execution-time limits;
    * implement rate limiting on the CAPTCHA endpoint;
    * destroy generated image resources after use.
    
    Example defensive limits could include reasonable maximum values for width, height, font size, and CAPTCHA length according to the application's intended interface.
    
    ## Patch Status
    
    No upstream fix was available at the time the CVE was requested and assigned.
    
    Users deploying affected versions should apply local validation and resource limits until an upstream fix becomes available.
    
    ## Timeline
    
    * **2026-03-23:** CVE request submitted.
    * **2026-07-23:** CVE-2026-50787 assigned by the CVE Assignment Team.
    * **2026-08-26:** Public advisory prepared.
    
    ## References
    
    * Affected project: [https://github.com/esiclivre/esiclivre](https://github.com/esiclivre/esiclivre)
    * Vulnerable component: [https://github.com/esiclivre/esiclivre/blob/master/restrito/inc/captcha.php](https://github.com/esiclivre/esiclivre/blob/master/restrito/inc/captcha.php)
    
    ## Credits
    
    Discovered and reported by **Bryan Romero**
    [https://github.com/brynax](https://github.com/brynax)
    
    ## Disclosure Note
    
    This advisory documents the vulnerability, its technical root cause, and recommended mitigations for defensive and remediation purposes. It intentionally omits automated denial-of-service tooling, high-volume exploitation methods, and operational instructions that could facilitate abuse.