PT-2022-7794 · Unknown · Simplepush Server

Published 2022-07-01 · Updated 2022-07-13 · CVE-2014-3648

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions simplepush server (affected versions not specified)

Description The issue allows an attacker to generate endless exceptions or slow down the server by registering bogus applications with bad deviceTokens. This can turn the server into a DDOS vector or an anonymizer for posting malware. The server iterates through application installations and pushes notifications to user-controlled servers provided by deviceToken. An attacker can provide any HTTP endpoint, potentially wasting the server's time with slow endpoints or causing it to generate exceptions when those endpoints cannot be reached.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2014-3648

Affected Products

Simplepush Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-3648 · Security Note
• https://issues.redhat.com/browse/AEROGEAR-6091 · Vendor Advisory
• https://t.me/cibsecurity/45478 · Telegram Post