CVE-2023-37279: Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input

Vulnerability summary

CVE-2023-37279 is a high (CVSS 7.5) vulnerability in contribsys faktory. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 60.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-09-2023
   PublishedVulnerability first disclosed.
2. 24-09-2024
   Last modifiedVulnerability information updated.

Description

Faktory is a language-agnostic persistent background job server. Prior to version 1.8.0, the Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`. The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. Version 1.8.0 fixes this issue.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
• CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.