Easy Chat Server 3.1 is susceptible to a remote denial of service vulnerability that can crash the application through a specially crafted HTTP POST request.

This vulnerability is a denial of service flaw (CWE-940) involving the improper verification of communication data. An unauthenticated remote attacker can establish a session via the chat.ghp endpoint and subsequently send a POST request to body2.ghp with an excessively large message parameter to force a service crash.

The exploitation of this vulnerability results in a complete denial of service for the chat application, rendering it unavailable to legitimate users. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to operational continuity, potentially causing service outages and productivity loss for organizations relying on this software for communication.

Immediate Action: As there is no official vendor patch available, administrators should restrict network access to the application to trusted internal segments only. If the service is not business-critical, consider deactivating the application until a secure alternative or vendor update is provided.

Proactive Monitoring: Monitor server logs for repeated POST requests to the body2.ghp endpoint that contain unusually long strings or anomalous message parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and drop incoming POST requests to body2.ghp that exceed a reasonable length for the message parameter.

Public Exploit Available: Yes, a proof of concept exploit exists, as documented in the ExploitDB entry 46806.

The risk associated with this vulnerability is significant due to the ease of execution and the lack of a vendor-supplied patch. Organizations currently running Easy Chat Server 3.1 must prioritize network segmentation and the deployment of WAF rules to prevent unauthorized access and potential service disruption. Decommissioning the software is strongly advised if it cannot be adequately isolated from public-facing network segments.