CVE-2024-49767

Werkzeug prior to 3.0.6 is vulnerable to resource exhaustion attacks.

• CVSS 6.9
• CWE-400
• Resource Management
• Remote

Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue.

CVE

CVE-2024-49767

CWE

CWE-400

CVSS base score

6.9

Published

2024-10-25

OWASP

A10 Insufficient Logging & Monitoring

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

Werkzeug

Fixed by upgrading

Yes

Solution

Upgrade Werkzeug to version 3.0.6 or later.

from flask import Flask, request

app = Flask(__name__)

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    file.save(f"./uploads/{file.filename}")
    return "File uploaded successfully", 200

if __name__ == '__main__':
    app.run()

from flask import Flask, request

app = Flask(__name__)

@app.route('/upload', methods=['POST'])
def upload_file():
    if request.content_length > 16 * 1024 * 1024:
        return "File too large", 413
    file = request.files['file']
    file.save(f"./uploads/{file.filename}")
    return "File uploaded successfully", 200

if __name__ == '__main__':
    app.run()

POST /upload HTTP/1.1
Host: vulnerable-app.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Length: 1000000000

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="largefile.bin"
Content-Type: application/octet-stream

<binary data>
------WebKitFormBoundary7MA4YWxkTrZu0gW--

@misc{vaitp:cve202449767,
  title        = {{Werkzeug prior to 3.0.6 is vulnerable to resource exhaustion attacks.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-49767},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-49767/}}
}