# Resource Consumption DOS on Edgemax v1.10.6

Oversized beaker.session.id cookie causes path disclosure; unique sub-250-char cookies fill /var/run/beaker/container_file until EdgeMAX web portal and device hang.

- Payout: hidden
- Severity: high
- Program: Ubiquiti Inc.
- Found by: grampae
- Disclosed: 2019-08-04
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/406614
- Library page: https://bugbountylibrary.com/r/h1%3A406614
- Tags: area:devices domain:network domain:web impact:dos kind:bounty platform:hackerone sev:high tech:python technique:recon vuln:dos vuln:info-disclosure

**Target:** EdgeMAX web management portal (beaker session handling)
**Root cause:** Beaker session middleware writes a cache file per unique session id into /var/run/beaker/container_file without bounding the number of sessions or cleaning them up; ids over 249 chars trigger an error page leaking the full path.
**Steps:**
1. Send `GET / HTTP/1.1` with `Cookie: beaker.session.id=<249-char unique value>` to the portal.
2. Repeat with many unique session ids (e.g. iterations 1-15681) to create one cache file each in `/var/run/beaker/container_file/`.
3. Observe 500/python error pages once /run mount reaches ~50%.
4. Continue until /run is full; /var/log then fills with write-failure complaints and the device stops responding.
5. Recover by deleting files in `/var/run/beaker/container_file/` or power-cycling.
**How found:** Noticed a 250+ char session id produced an error page with full path disclosure, then observed valid-length ids were stored as .cache files in /var/run/beaker/container_file/, suggesting unbounded file creation.
**Exploitation:** Automated loop of requests with unique beaker.session.id cookies (<=249 chars) fills the /run tmpfs with cache files, exhausting space and hanging the portal and device until power cycle.
**Escalation:** Filling /run cascades into /var/log exhaustion, taking the whole device offline rather than just the web portal.
**Insight:** Session middleware that persists one file per session id (Beaker) is a DoS surface: send many unique cookie values and watch the tmpfs mount fill; oversized ids often leak paths via error pages.