Lucene search

GoogleOSV:CVE-2024-23826

HistoryJan 29, 2024 - 4:15 p.m.

CVE-2024-23826

2024-01-2916:15:09

Google

osv.dev

cve-2024-23826

department of system programming

st. petersburg state university

avatar image upload

unicode filename

server-side denial of service

windows os

filename length limitation

unicode normalization

vulnerability fix

2024.01.29 release

software

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

13.3%

JSON

spbu_se_site is the website of the Department of System Programming of St. Petersburg State University. Before 2024.01.29, when uploading an avatar image, an authenticated user may intentionally use a large Unicode filename which would lead to a server-side denial of service under Windows. This is due to no limitation of the length of the filename and the costly use of the Unicode normalization with the form NFKD on Windows OS. This vulnerability was fixed in the 2024.01.29 release.

References

github.com/spbu-se/spbu_se_site/commit/5ad623eb0405260763046343c5785bc588d8a57d

github.com/spbu-se/spbu_se_site/security/advisories/GHSA-5vfc-v7hg-pvwm