PT-2023-32940 · Unknown · Encoded Id-Rails
Stevegeek
·
Publicado
2023-10-24
·
Atualizado
2026-05-14
·
CVE-2024-0241
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
encoded id-rails versions before 1.0.0.beta2
Description
The issue is an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial of service condition by sending an HTTP request with an extremely long
id parameter. This can lead to high CPU consumption and allocation of a large number of intermediate objects, causing the application to spend a significant amount of time decoding the ID.Recommendations
Upgrade to version 1.0.0.beta2, which introduces a new option to limit the length of IDs that can be decoded, mitigating the vulnerability. As a temporary workaround, consider restricting access to the
id parameter in the affected API endpoint until the issue is resolved.Exploit
Correção
DoS
Allocation of Resources Without Limits
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Encoded Id-Rails