| शीर्षक | OWASP DefectDojo <= 2.55.4 Denial of Service |
|---|
| विवरण | Multiple components within DefectDojo, specifically SonarQubeParser and MSDefenderParser, are vulnerable to a Zip Bomb (Denial of Service) attack. These parsers employ an unsafe file reading pattern (input_zip.read(name)) when processing user-uploaded ZIP archives. This method indiscriminately loads the entire uncompressed content of files into the server's memory without validating the size or compression ratio. An authenticated attacker who has the permission to upload findings can exploit this by uploading a small, highly compressed ZIP file (e.g., ~5MB) that expands to a massive size (e.g., 5GB or more) upon extraction. This triggers an Out-Of-Memory (OOM) condition, causing the application process to crash and leading to a Denial of Service.
Fixation PR: https://github.com/DefectDojo/django-DefectDojo/pull/14408 |
|---|
| स्रोत | ⚠️ https://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip_bomb_dos_oom/dfdj_zip_bomb_dos_oom.md |
|---|
| उपयोगकर्ता | h3nrrrych4u (UID 95805) |
|---|
| सबमिशन | 28/02/2026 07:34 AM (8 महीनों पहले) |
|---|
| संयम | 08/03/2026 06:23 PM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 349782 [OWASP DefectDojo तक 2.55.4 SonarQubeParser/MSDefenderParser parser.py input_zip.read सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|