PT-2021-22479 · Ifttt+1 · Ifttt+1

Rasmus Petersen · Published 2021-09-20 · Updated 2021-10-04 · CVE-2021-39229

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apprise versions prior to 0.9.5.1

Description The issue affects users of Apprise who have granted access to the IFTTT plugin, making them subject to a denial of service attack due to an inefficient regular expression. The vulnerable regular expression is located in the NotifyIFTTT.py file. This issue has been patched in release version 0.9.5.1.

Recommendations For versions prior to 0.9.5.1, update to Apprise v0.9.5.1 by running pip install apprise==0.9.5.1. As a temporary workaround for users unable to upgrade, consider removing the apprise/plugins/NotifyIFTTT.py file to eliminate the vulnerable service, although this will disable IFTTT notification functionality.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-39229

GHSA-QHMP-H54X-38QR

PYSEC-2021-327

Affected Products

Apprise

Ifttt

References · 12

• 🔥 https://github.com/caronc/apprise/blob/0007eade20934ddef0aba38b8f1aad980cfff253/apprise/plugins/NotifyIFTTT.py#L356-L359 · Exploit
• https://github.com/caronc/apprise/pull/436 · Patch
• https://osv.dev/vulnerability/GHSA-qhmp-h54x-38qr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39229 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-327 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39229 · Vendor Advisory
• https://github.com/caronc/apprise/security/advisories/GHSA-qhmp-h54x-38qr · Note
• https://github.com/caronc/apprise · Note
• https://github.com/caronc/apprise/commit/e20fce630d55e4ca9b0a1e325a5fea6997489831 · Note
• https://github.com/caronc/apprise/releases/tag/v0.9.5.1 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apprise/PYSEC-2021-327.yaml · Note
• https://t.me/cvenotify/21201 · Telegram Post