[DoS] - Real-debrid.fr Torrent2ddl

[Xpo Xpo <smashxpo () gmail com>]

Real-debrid's a "popular" french website offering a debrid service for a
lot of online hosting services, almost one hundred...

It also proposes another service https://real-debrid.fr/torrents allowing
you to upload torrent contents to a ddl hosting service (like Uptobox,
Mega, ...), only available for customers who paid.

Problem is that If you add a torrent (file or magnet) with an adequate size
of torrent contents (1,7TB is doing at least the trick), you're able to
handle a Denial of Service on the whole torrent2ddl service and crash all
the torrents processed at the time for all the customers.

The vulnerability is due to a very poor design of the service where the
whole size of the torrent contents isn't even checked at all by the
script(s) processing them, maybe also here by the lack of using an
extensible cloud service instead of normal servers.

The vendor was contacted, I don't know exactly if the vulnerability was
fixed since he banned manually the account used to discover it and he
didn't want to unban it since, not even answering anymore on the "fake"
support or the forum.

By the way, I guess that other similar services could have also the same
kind of vulnerabilities.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/