plone/plone.rest · Security
plone.rest vulnerable to Denial of Service when ++api++ is used many times
- GHSA ID
- GHSA-h6rp-mprm-xgcq
- CVE ID
- CVE-2023-42457
- Severity
- medium
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v4
- 6.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Description
Impact
When the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive.
Patches
Patches will be released in plone.rest 2.0.1 and 3.0.1. Series 1.x is not affected.
Workarounds
In your frontend web server (nginx, Apache) you can redirect /++api++/++api++ to /++api++.
CWEs
- CWE-400 · Uncontrolled Resource Consumption
- CWE-770 · Allocation of Resources Without Limits or Throttling
References
- https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-42457 ↗
- https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7 ↗
- https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302 ↗
- http://www.openwall.com/lists/oss-security/2023/09/22/2 ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/plone-rest/PYSEC-2023-178.yaml ↗
- https://github.com/advisories/GHSA-h6rp-mprm-xgcq ↗