Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests
概要
Impact
The authenticated POST /messages/render endpoint renders arbitrary user-supplied Markdown but, unlike the message send and edit endpoints, did not enforce Zulip's normal message length limit on its content parameter.
As a result, a single request could supply content up to the serve...
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| Zulip Server |
<= 12.1 |
12.2 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Impact
The authenticated POST /messages/render endpoint renders arbitrary user-supplied Markdown but, unlike the message send and edit endpoints, did not enforce Zulip's normal message length limit on its content parameter.
As a result, a single request could supply content up to the server's body-size limit to be rendered. Processing requests of this size would consume a disproportionate amount of backend CPU, and repeated or concurrent requests from a single authenticated account could degrade Markdown rendering performance or backend availability for other users.
Patches
Fixed in Zulip server 12.2.
出典: GitHub Repository Security Advisories (Game のスタック) NVD GitHub Advisory
参照URL
- GITHUB_REPO_ADVISORY zulip/zulip