logo

Database

Java Denial Of Service By Sleep

Description

Detects potential Denial of Service vulnerabilities caused by Thread.sleep() calls with untrusted duration values in Java web applications. An attacker could exploit this by supplying manipulated input that triggers long sleep periods, causing the application to become unresponsive.

Weakness:

067 - Improper resource allocation

Category: Functionality Abuse

Detection Strategy

    • Checks if the Java web application uses servlet imports (javax.servlet.http.* or jakarta.servlet.http.*)

    • Identifies Thread.sleep() method calls in the codebase

    • Verifies if the sleep duration parameter comes from untrusted sources like HTTP request parameters

    • Reports a vulnerability when sleep duration can be controlled through user input in web request handlers

Vulnerable code example

import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

public class VulnerableServlet extends HttpServlet {
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws Exception {
        String userInput = req.getParameter("sleeptime"); // Untrusted user input directly controls sleep duration
        Thread.sleep(Long.parseLong(userInput)); // Vulnerable: allows attacker to cause denial of service...

✅ Secure code example

import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

public class SecureServlet extends HttpServlet {
    private static final long MAX_SLEEP_TIME = 5000; // Maximum allowed sleep time in milliseconds
    
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws Exception {...