CVE-2025-53636: Open OnDemand HPC Portal DoS Vulnerability

CVE-2025-53636 Overview

CVE-2025-53636 is a denial-of-service vulnerability in Open OnDemand, an open-source high-performance computing (HPC) portal. Authenticated users can flood system logs by interacting with the shell application and triggering repeated errors. The resulting log growth can exhaust disk space and render the OnDemand service unavailable to legitimate users. The issue is tracked under [CWE-400: Uncontrolled Resource Consumption] and is fixed in versions 3.1.14 and 4.0.6.

Critical Impact

Any authenticated Open OnDemand user can generate excessive log entries through the shell app, exhausting disk capacity and disrupting HPC portal availability.

Affected Products

• Open OnDemand versions prior to 3.1.14 (3.1.x branch)
• Open OnDemand versions prior to 4.0.6 (4.0.x branch)
• Deployments exposing the shell application to authenticated users

Discovery Timeline

• 2025-07-11 - CVE-2025-53636 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53636

Vulnerability Analysis

The vulnerability resides in the shell application shipped with Open OnDemand, specifically in apps/shell/app.js. When a user interacts with the shell app in ways that produce errors, each error generates a corresponding log entry with no rate limiting or deduplication. An authenticated user can trigger the error path repeatedly, causing the log file to grow without bound.

The practical result is disk exhaustion on the host running OnDemand. When the filesystem fills, the portal, dependent services, and other tenants sharing the volume can fail. Because Open OnDemand often fronts shared HPC infrastructure, a single misbehaving or malicious user can degrade service for an entire user community.

Root Cause

The root cause is missing throttling and deduplication in the shell app's logging path. Every error condition produced a discrete console.log entry. Without a mechanism to combine repeated messages or rate-limit output, log volume scaled linearly with user-controlled input.

Attack Vector

Exploitation requires network access to the OnDemand portal and valid low-privilege credentials. An attacker interacts with the shell application in a manner that repeatedly triggers server-side errors. Each interaction adds entries to the shell log file until storage is exhausted or log rotation cannot keep pace.

// Patch: Combines duplicated lines into a single message
// (log message + number of skipped messages)
function createLogger() {
  // Combine logs for logInterval ms duration
  const logInterval = 5000;
  const messages = [];
  let lastLog = 0;
  let timer;

  const logQueuedMessages = (immediate = false) => {
    const now = Date.now();
    clearTimeout(timer);
    // Nothing logged since logInterval, log immediately
    if (now - lastLog > logInterval || immediate) {
      for (const { message, count } of messages) {
        console.log(message);
        if (count > 1) {
          console.log(`Skipped ${count-1} previous duplicated messages`);
        }
      }
      messages.length = 0;
      lastLog = now;
    } else if (messages.length > 0) {
      // Log at most logInterval duration since current queue started
      timer = setTimeout(logQueuedMessages, (lastLog + logInterval - now));
    }
  }

Source: GitHub commit 40800d6. The patch introduces a queued logger that batches duplicate messages within a 5-second window and emits a single summary line noting how many duplicates were skipped.

Detection Methods for CVE-2025-53636

Indicators of Compromise

• Rapid, sustained growth of Open OnDemand shell application log files beyond baseline rates.
• Repeated identical or near-identical error messages emitted from apps/shell/app.js within short time windows.
• Filesystem free-space alerts on the volume hosting OnDemand logs.
• Elevated shell app session activity tied to a single authenticated user identity.

Detection Strategies

• Monitor log file size deltas for /var/log/ondemand-nginx/ and shell app log paths on a per-minute basis.
• Correlate spikes in log volume with authenticated session identifiers to attribute activity to specific users.
• Alert on repeated identical error strings exceeding a defined threshold within a rolling window.

Monitoring Recommendations

• Configure disk-usage thresholds with alerts at 70%, 85%, and 95% capacity on the log volume.
• Enable log rotation with strict size caps and compression for OnDemand shell logs.
• Forward OnDemand logs to a central logging platform to detect anomalies before local disks fill.

How to Mitigate CVE-2025-53636

Immediate Actions Required

• Upgrade Open OnDemand to version 3.1.14 or 4.0.6 or later without delay.
• Audit current shell application log files and rotate or truncate any that have grown beyond expected size.
• Verify sufficient free disk capacity on the volume hosting OnDemand logs before patching.

Patch Information

The fix is delivered in Open OnDemand 3.1.14 and 4.0.6. Refer to GitHub Security Advisory GHSA-x5xv-fw37-v524 and the upstream commits 40800d6 and 96f29b9 for implementation details. The patch introduces a batched createLogger() that collapses duplicate messages emitted within a 5-second interval.

Workarounds

• Enforce aggressive logrotate policies with strict maxsize and rotate limits on shell app logs.
• Place the OnDemand log directory on a dedicated filesystem to prevent host-wide impact when logs grow.
• Temporarily restrict access to the shell application to trusted users until patches are deployed.

# Example logrotate configuration for Open OnDemand shell logs
/var/log/ondemand-nginx/*/error.log {
    size 100M
    rotate 5
    compress
    missingok
    notifempty
    copytruncate
}