| शीर्षक | Rowboat Labs Rowboat 0.1.0 Denial of Service |
|---|
| विवरण | Rowboat exposes PUT /api/uploads/{fileId} without authentication or a one-time upload token. The endpoint accepts an attacker-controlled fileId, fully buffers the request body in Node.js memory via request.arrayBuffer(), and writes the complete body to RAG_UPLOADS_DIR via fs.writeFile().
The route does not verify that the fileId was issued by the authenticated upload workflow and does not require a valid project, data source, or document record before writing to disk. It also lacks a pre-read file size limit, tenant storage quota, upload-directory quota, and global disk quota.
An unauthenticated attacker can repeatedly upload large request bodies to arbitrary file IDs and consume shared server-side storage. Once the upload directory is exhausted, legitimate file uploads and RAG knowledge-base ingestion fail with server errors. If RAG_UPLOADS_DIR shares a filesystem with logs, temporary files, or runtime state, disk exhaustion may also affect other application functions. |
|---|
| स्रोत | ⚠️ https://github.com/outlookgp/CVE/tree/main/Rowboat_Anonymous_Upload_Disk_DoS_Report |
|---|
| उपयोगकर्ता | outlookgp (UID 99658) |
|---|
| सबमिशन | 11/07/2026 08:59 AM (3 महीनों पहले) |
|---|
| संयम | 02/09/2026 03:16 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 315026 [rowboatlabs rowboat तक 8096eaf63b5a0732edd8f812bee05b78e214ee97 Session route.ts PUT params कमजोर प्रमाणीकरण] |
|---|
| अंक | 0 |
|---|