PT-2023-31911 · Unknown · Revanced Api

Validcube · Published 2023-12-27 · Updated 2024-01-04 · CVE-2023-52075

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ReVanced API versions up to and including commit 71f81f7f20cd26fd707335bca9838fa3e7df20d2

Description The ReVanced API proxies requests to feed the ReVanced Manager and website with data. However, it lacks error caching, causing the rate limit to be triggered and increasing server load. This results in a denial of service for all users using the API.

Recommendations Implement proper error caching to prevent the rate limit from being triggered and to reduce server load. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2023-52075

GHSA-852X-GRXP-8P3Q

Affected Products

Revanced Api

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52075.json · Exploit
• https://github.com/ReVanced/revanced-api/security/advisories/GHSA-852x-grxp-8p3q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-52075 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52075 · Security Note
• https://twitter.com/VulmonFeeds/status/1740124036632371532 · Twitter Post
• https://twitter.com/RedPacketSec/status/1740674629839065348 · Twitter Post
• https://twitter.com/CVEnew/status/1740104402726244660 · Twitter Post
• https://t.me/cvenotify/65274 · Telegram Post