CVE-2018-1000115
HIGHmemcached 1.5.5 - Denial of Service via UDP Traffic Amplification
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2018-1000115.
PoCs published by 649, anonymous, Marek Majkowski, including Metasploit module auxiliary/scanner/memcached/memcached_amp.
AI-analyzed exploit summary This exploit leverages CVE-2018-1000115 to perform a distributed denial-of-service (DDoS) attack by spoofing UDP packets to vulnerable Memcached servers, amplifying traffic to a target. It uses the Shodan API to discover vulnerable servers and allows customization of payload and attack power.
Description
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
Exploits (3)
This exploit leverages CVE-2018-1000115 to perform a distributed denial-of-service (DDoS) attack by spoofing UDP packets to vulnerable Memcached servers, amplifying traffic to a target. It uses the Shodan API to discover vulnerable servers and allows customization of payload and attack power.
This exploit is a proof-of-concept for CVE-2028-1000115, demonstrating a UDP amplification attack against memcached servers. It spoofs UDP packets to reflect traffic to a target, leveraging vulnerable memcached instances.
This Metasploit module scans for Memcached servers exposing UDP port 11211 and checks for vulnerability to amplification attacks by sending a 'stats' request and analyzing the response. It does not exploit a vulnerability but identifies potential targets for DRDoS attacks.
References (15)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H