| 제목 | Opptrix Opptrix Server v0.4.0 Denial of Service |
|---|
| 설명 | A self-hosted Opptrix server (open source, github.com/Travisun/Opptrix) registers an unauthenticated webhook route, POST /api/channels/webhook/{id}, for incoming channel messages. On requests with a body, the Fastify preParsing handler concatenates stream chunks with Buffer.concat after they have already been converted to strings (Fastify 5.11 setEncoding interaction), which throws ERR_INVALID_ARG_TYPE inside an asynchronous onRequest-stage hook; the exception is uncaught and terminates the whole process via uncaughtException.
A single request with an arbitrary JSON body crashes the server: the channel id does not need to exist, no authentication or channel configuration is required, and the crash is unconditional and immediately repeatable, so the service can be kept offline indefinitely by re-sending one request after each restart.
Verified against the current main branch on Windows. The webhook routes have not shipped in any released package yet. Impact: unconditional remote denial of service against any instance state, with no prerequisites. |
|---|
| 원천 | ⚠️ https://drive.google.com/drive/folders/1-crbh2joNwFbpXSQ4Iz1U0dSPy4ZTSf_?usp=sharing |
|---|
| 사용자 | fifker (UID 101353) |
|---|
| 제출 | 2026. 09. 19. PM 03:31 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 24. AM 02:49 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 426052 [Travisun Opptrix 0.4.0 preParsing handler /api/channels/webhook/ Buffer.concat 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|