CVE-2023-49800 Denial of service by abusing `fetchOptions.retry` in nuxt-api-party

2023-12-0823:41:55

CWE-674

CWE-400

GitHub_M

www.cve.org

cve-2023-49800

nuxt-api-party

stack overflow

ofetch

security vulnerability

upgrade

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

17.0%

JSON

nuxt-api-party is an open source module to proxy API requests. The library allows the user to send many options directly to ofetch. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directly from the request body. A malicious user can construct a URL known to not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively resulting in a denial of service. This issue has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should limit ofetch options.

CNA Affected

[
  {
    "vendor": "johannschopplich",
    "product": "nuxt-api-party",
    "versions": [
      {
        "version": "< 0.22.1",
        "status": "affected"
      }
    ]
  }
]