| 标题 | Opptrix Opptrix Server v0.4.0 Denial of Service |
|---|
| 描述 | A self-hosted Opptrix server (open source, github.com/Travisun/Opptrix) registers an unauthenticated webhook route, POST /api/channels/webhook/{id}, for incoming channel messages. On requests with a body, the Fastify preParsing handler concatenates stream chunks with Buffer.concat after they have already been converted to strings (Fastify 5.11 setEncoding interaction), which throws ERR_INVALID_ARG_TYPE inside an asynchronous onRequest-stage hook; the exception is uncaught and terminates the whole process via uncaughtException.
A single request with an arbitrary JSON body crashes the server: the channel id does not need to exist, no authentication or channel configuration is required, and the crash is unconditional and immediately repeatable, so the service can be kept offline indefinitely by re-sending one request after each restart.
Verified against the current main branch on Windows. The webhook routes have not shipped in any released package yet. Impact: unconditional remote denial of service against any instance state, with no prerequisites. |
|---|
| 来源 | ⚠️ https://drive.google.com/drive/folders/1-crbh2joNwFbpXSQ4Iz1U0dSPy4ZTSf_?usp=sharing |
|---|
| 用户 | fifker (UID 101353) |
|---|
| 提交 | 2026-09-19 15時31分 (1 月前) |
|---|
| 管理 | 2026-10-24 02時49分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 426052 [Travisun Opptrix 0.4.0 preParsing handler /api/channels/webhook/ Buffer.concat 拒绝服务] |
|---|
| 积分 | 20 |
|---|