Skip to main content

Allocation of Resources Without Limits or Throttling

CVE-2024-52796

Medium
6.9/10

Summary

Password Pusher, an open source application to communicate sensitive information over the web, comes with a configurable rate limiter. In versions prior to 1.49.0, the rate limiter could be bypassed by forging proxy headers allowing bad actors to send unlimited traffic to the site potentially causing a Denial Of Service (DOS). A fix was implemented to only authorize proxies on local IPs which resolves this issue. As a workaround, one may add rules to one's proxy and/or firewall to not accept external proxy headers such as "X-Forwarded-*" from clients.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published