PT-2023-25879 · Faktory · Faktory

Malayke · Published 2023-09-20 · Updated 2024-08-21 · CVE-2023-37279

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Faktory versions prior to 1.8.0

Description The Faktory web dashboard can suffer from denial of service by a crafted malicious URL query parameter days. This issue is related to how the backend reads the days URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash.

Recommendations For versions prior to 1.8.0, update to version 1.8.0 to resolve the issue. As a temporary workaround, consider restricting access to the Faktory web dashboard to minimize the risk of exploitation. Avoid using the days parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-789

Related Identifiers

CVE-2023-37279

GHSA-X4HH-VJM7-G2JV

GO-2023-2067

Affected Products

Faktory

References · 12

• 🔥 https://github.com/contribsys/faktory/security/advisories/GHSA-x4hh-vjm7-g2jv · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37279.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-37279 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37279 · Security Note
• https://osv.dev/vulnerability/GHSA-x4hh-vjm7-g2jv · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2067 · Vendor Advisory
• https://github.com/contribsys/faktory · Note
• https://t.me/cvenotify/58545 · Telegram Post
• https://twitter.com/cracbot/status/1704737306043888005 · Twitter Post
• https://t.me/cvenotify/58235 · Telegram Post
• https://twitter.com/CVEnew/status/1704610917718323570 · Twitter Post
• https://t.me/cibsecurity/70863 · Telegram Post