Collected research

Save Your Cloud: DoS on VMs in OpenNebula 4.6.1

Renaming an OpenNebula virtual machine to a name holding an unclosed XML tag makes the backend auto-close it in the wrong place, producing a record that no longer matches the expected schema. The core then fails to parse that machine's entry, so it can no longer be controlled from the Sunstone web interface, and version 4.6.1 has no CSRF protection to stop a forced rename.

Record

Published by

web-in-security.blogspot.com

Topic

Server

In the archive

• Collected in the 2018 research round

Related sources

• Private cloud denial-of-service research

Tags

• dos
• csrf
• injection
• parser-differential
• sanitizer-bypass
• case-study
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of web-in-security.blogspot.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.