PT-2023-20174 · Npm · Fastify-Multipart

Das7Pad + 1 · Publicado 2023-02-14 · Atualizado 2023-02-22 · CVE-2023-25576

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions @fastify/multipart versions prior to 6.0.1 and 7.4.1

Description The issue is related to the @fastify/multipart plugin, which may experience denial of service due to accepting an unlimited number of parts. This includes the multipart body parser accepting an unlimited number of file parts, field parts, and empty parts as field parts.

Recommendations For versions prior to 6.0.1, update to version 6.0.1 or later. For versions prior to 7.4.1, update to version 7.4.1 or later.

Exploit

Correção

Resource Exhaustion

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-400

CWE-770

Identificadores relacionados

CVE-2023-25576

GHSA-HPP2-2CR5-PF6G

Produtos afetados

Fastify-Multipart

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25576.json · Exploit
• https://github.com/fastify/fastify-multipart · Nota
• https://github.com/fastify/fastify-multipart/releases/tag/v7.4.1 · Nota
• https://github.com/fastify/fastify-multipart/releases/tag/v6.0.1 · Nota
• https://github.com/fastify/fastify-multipart/commit/85be81bedf5b29cfd9fe3efc30fb5a17173c1297 · Correção
• https://github.com/fastify/fastify-multipart/security/advisories/GHSA-hpp2-2cr5-pf6g · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25576 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-hpp2-2cr5-pf6g · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-25576 · Aviso do Fabricante
• https://hackerone.com/reports/1816195 · Nota
• https://t.me/cibsecurity/58114 · Publicação no Telegram