CVE-2019-16889 : Exploit Details and Defense Strategies

Ubiquiti EdgeMAX devices before version 2.0.3 are vulnerable to a denial of service attack due to a specific payload in the beaker.session.id cookie.

Understanding CVE-2019-16889

This CVE identifies a vulnerability in Ubiquiti EdgeMAX devices that can be exploited by remote attackers to cause a denial of service attack.

What is CVE-2019-16889?

Before version 2.0.3, a vulnerability exists in Ubiquiti EdgeMAX devices that allows remote attackers to trigger a denial of service attack by creating *.cache files in a specific directory.

The Impact of CVE-2019-16889

The vulnerability can lead to a denial of service attack resulting in disk consumption on affected devices.

Technical Details of CVE-2019-16889

This section provides more in-depth technical information about the CVE.

Vulnerability Description

The vulnerability arises from the creation of *.cache files in the /var/run/beaker/container_file/ directory when a valid length payload is provided to the beaker.session.id cookie.

Affected Systems and Versions

Ubiquiti EdgeMAX devices before version 2.0.3

Exploitation Mechanism

Attackers can exploit the vulnerability by providing a valid length payload of 249 characters or less to the beaker.session.id cookie.

Mitigation and Prevention

Protecting systems from CVE-2019-16889 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update Ubiquiti EdgeMAX devices to version 2.0.3 or newer.
Monitor disk consumption and unusual file creation.

Long-Term Security Practices

Regularly update firmware and security patches.
Implement network segmentation and access controls.

Patching and Updates

Apply patches and updates provided by Ubiquiti for EdgeMAX devices.