Outsystems Platform Server CVE-2025-61258 DoS Vulnerability Analysis

Vulnerability Overview CVE ID: CVE-2025-61258 Vulnerability Type: Denial-of-service (DoS) Description: A denial-of-service vulnerability was identified during penetration testing of the API developed by OutSystems. This vulnerability affects the API, web server, and OutSystems dashboard, impacting the entire OutSystems Platform Server. Affected Platform: OutSystems Platform Server 11.18.1.37828 Impact Scope Affected Product: OutSystems Platform Server Affected Version: 11.18.1.37828 CVSS Score: 8.2 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VA:N/SC:N/SI:N/SA:L Impact: The vulnerability may cause the server to hang and become unresponsive to requests, thereby affecting all applications deployed on the OutSystems platform. Remediation Official Fix: No official fix or patch is currently available. Temporary Mitigation Measures: - Configure hard timeouts to terminate long-standing TCP and HTTP sessions. - Set maximum concurrent connection limits to restrict the number of connections from a single source. - Implement general brute-force attack prevention measures. POC Code Technical Description Vulnerability Principle: Sending a POST request with a forged header causes the server to hang. Exploitation Method: Create multiple concurrent HTTP requests to slowly transmit data, exhausting server resources. Example Tool: Use the tool for exploitation. Timeline September 2025: Discovered and reported to the customer September 2025: Submitted to MITRE’s CVE program December 2025: Public disclosure Disclosure Disclosing Party: Balwark attempted to contact OutSystems through multiple channels but received no official response. References Cloudflare DDoS Attack Tools OutSystems Official Website

Goal Reached Thanks to every supporter — we hit 100%!

Outsystems Platform Server CVE-2025-61258 DoS Vulnerability Analysis