CVE-2023-37279 Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input

2023-09-2021:27:22

CWE-770

CWE-789

GitHub_M

www.cve.org

faktory background job server

denial of service

url query parameter

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

33.2%

JSON

Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.

CNA Affected

[
  {
    "vendor": "contribsys",
    "product": "faktory",
    "versions": [
      {
        "version": "< 1.8.0",
        "status": "affected"
      }
    ]
  }
]