Vulnerability information
=========================

Title: phpBB Native Fulltext Search denial of service
CVE ID: CVE-2019-9826
CVSSv3 score: 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)

Vulnerability description
=========================

Improper input validation in the Native Fulltext Search component of 
phpBB 3.2.5 and earlier allows an unauthenticated remote user to trigger 
a denial of service attack via the keywords URL parameter of search.php.

Successful exploitation generates a slow SQL query which causes the 
database engine used by phpBB to consume all available CPU resources. 
Depending upon the database engine, users will also be completely unable 
to create or modify posts due to locks on the search index tables. The 
slowness of the query depends on the size of the search_wordlist and 
search_wordmatch tables.

Because the denial of service is caused by a long-running database 
query, for a typical phpBB installation running on MySQL/Linux, only <# 
CPUs> requests need to be made by an attacker in order to consume all 
CPU resources available to the database engine. The slow query will 
continue to run after the attacker disconnects because PHP does not 
detect connection aborts until it tries to send data back to the client.

Vulnerable packages
===================

phpBB 3.2.5 and earlier when configured to use the Native Fulltext 
search component. (This is the default configuration.)

Solutions and workarounds
=========================

The vendor has released phpBB 3.2.6, which improves input validation in 
the Native Fulltext Search component.

Mitigations are available for earlier versions of phpBB:

1. Set “Search backend” to an engine other than “phpBB Native Fulltext”
2. Set the “Can search board” group permission to “No” for all untrusted 
user groups
3. Set “Enable search facilities” to “No”

Proof of concept
================

Due to the triviality of the attack, proof of concept code is withheld 
for the moment in order to allow users some time to test and install the 
vendor patch.

Report timeline
===============

The vendor was given a initial disclosure deadline of 2019-04-22. A one 
week grace period was granted so that a fixed release could be available 
at the time of disclosure.

2019-02-18: Initial disclosure to vendor with PoC and candidate patch
2019-02-19: Vendor acknowledges receipt of report
2019-03-12: Update requested
2019-03-13: Vendor verifies vulnerability
2019-03-15: Vendor assigns CVE ID
2019-03-19: Follow-up, no response
2019-04-15: Second follow-up
2019-04-18: Vendor requests extension to disclosure date
2019-04-22: One week extension granted
2019-04-29: Vendor patch released
2019-04-29: Public disclosure