PT-2024-24342 · Mealie · Mealie
Logan Maclaren
+1
·
Published
2024-04-19
·
Updated
2024-04-22
·
CVE-2024-31992
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Mealie versions prior to 1.4.0
Description
The issue arises from the
safe scrape html function, which uses a user-controlled URL to make requests to a remote server without rate limiting. Although there are efforts to prevent DDoS attacks by implementing timeouts, an attacker can still issue a large number of requests that will be handled in batches based on the Mealie server configuration. The chunking of responses helps mitigate memory exhaustion, but a single request to a large external file can saturate a CPU core assigned to the Mealie container. Without rate limiting, it is possible to sustain traffic against an external target indefinitely and exhaust the CPU resources assigned to the Mealie container.Recommendations
For versions prior to 1.4.0, update to version 1.4.0 to resolve the issue. As a temporary workaround, consider implementing rate limiting on requests to the
safe scrape html function to prevent CPU resource exhaustion. Restrict access to external files that could be used to saturate CPU resources.Exploit
Fix
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mealie