PT-2023-20175 · Starlite · Starlite
Das7Pad
·
Publicado
2023-02-15
·
Atualizado
2024-11-20
·
CVE-2023-25578
CVSS v4.0
8.7
Alta
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
starlite versions prior to 1.5.2
Description
The request body parsing in
starlite allows a potentially unauthenticated attacker to consume a large amount of CPU time and RAM. This is a remote, potentially unauthenticated Denial of Service vulnerability. The multipart body parser processes an unlimited number of file parts and an unlimited number of field parts. This vulnerability affects applications with a request handler that accepts a Body(media type=RequestEncodingType.MULTI PART). The large amount of CPU time required for processing requests can block all available worker processes and significantly delay or slow down the processing of legitimate user requests. The large amount of RAM accumulated while processing requests can lead to Out-Of-Memory kills. Complete DoS is achievable by sending many concurrent multipart requests in a loop.Recommendations
As a temporary workaround, consider disabling the
Body(media type=RequestEncodingType.MULTI PART) request handler until a patch is available.
Update to version 1.5.2 or later to resolve the issue.Exploit
Correção
Resource Exhaustion
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Starlite