PT-2025-12095 · Invokeai · Invokeai

Publicado 2025-03-20 · Atualizado 2025-03-20 · CVE-2024-11043

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions invoke-ai/invokeai version v5.0.2

Description A Denial of Service (DoS) issue was discovered in the "/api/v1/boards/{board id}" endpoint. This occurs when an excessively large payload is sent in the board name field during a PATCH request, causing the UI to become unresponsive and making it impossible for users to interact with or manage the affected board. The option to delete the board also becomes inaccessible.

Recommendations For invoke-ai/invokeai version v5.0.2, consider restricting access to the "/api/v1/boards/{board id}" endpoint to prevent exploitation until a fix is available. As a temporary workaround, limit the size of the payload that can be sent in the board name field to prevent the UI from becoming unresponsive.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2024-11043

GHSA-FFH5-W482-C7M5

Produtos afetados

Invokeai

Referências · 6

• 🔥 https://huntr.com/bounties/9270900a-b8b7-402f-aee5-432d891e5648 · Exploit
• https://github.com/invoke-ai/InvokeAI · Nota
• https://github.com/invoke-ai/InvokeAI/blob/b79f2a4e4f183db9016584813748a69d34d62a26/invokeai/app/services/shared/invocation_context.py#L76 · Nota
• https://twitter.com/CVEnew/status/1902671006684316095 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-11043 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-ffh5-w482-c7m5 · Aviso do Fabricante