PT-2024-20108 · Microsoft · Windows

Iakov + 1 · Published 2024-01-29 · Updated 2024-02-08 · CVE-2024-23826

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions spbu se site versions prior to 2024.01.29

Description The issue arises when an authenticated user uploads an avatar image with a large Unicode filename, leading to a server-side denial of service under Windows. This is due to the lack of limitation on the filename length and the costly use of Unicode normalization with the form NFKD on Windows OS.

Recommendations For versions prior to 2024.01.29, update to the 2024.01.29 release to resolve the issue. As a temporary workaround, consider restricting the length of filenames for avatar uploads to prevent potential denial of service attacks.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2024-23826

GHSA-5VFC-V7HG-PVWM

Affected Products

Windows

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23826.json · Exploit
• 🔥 https://github.com/spbu-se/spbu_se_site/security/advisories/GHSA-5vfc-v7hg-pvwm · Exploit
• https://github.com/spbu-se/spbu_se_site/commit/5ad623eb0405260763046343c5785bc588d8a57d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-23826 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23826 · Vendor Advisory
• https://t.me/cvenotify/70612 · Telegram Post