CVE-2024-53981

python-multipart <0.0.18 allows DoS via excessive logging from crafted multipart form data with extra bytes before/after boundaries.

• CVSS 7.5
• CWE-770
• Resource Management
• Remote

python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed in 0.0.18.

CVE

CVE-2024-53981

CWE

CWE-770

CVSS base score

7.5

Published

2024-12-02

OWASP

A07 Resource Exhaustion

Orthogonal defect classification

Timing/Serialization

Code defect classification

Timing Issues

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

python-multi

Fixed by upgrading

Yes

Solution

Upgrade python-multipart to version 0.0.18 or later.

import logging

def parse_multipart(data, boundary):
    logging.info("Parsing started...")
    parts = data.split(boundary) 

    for part in parts[1:-1]: 
        logging.info("Processing part: %s", part)

    logging.info("Parsing finished...") 


logging.basicConfig(level=logging.INFO)

import logging

def parse_multipart(data, boundary):
    logging.info("Parsing started...")

    if not boundary:
        logging.error("No boundary specified")
        return

    if boundary not in data:
        logging.error("Boundary not found in data")
        return

    parts = data.split(boundary)

    for part in parts[1:-1]:
        part_preview = part[:100]
        logging.info("Processing part: %s", part_preview)

    logging.info("Parsing finished...") 

logging.basicConfig(level=logging.INFO)

A'*100000000

@misc{vaitp:cve202453981,
  title        = {{python-multipart <0.0.18 allows DoS via excessive logging from crafted multipart form data with extra bytes before/after boundaries.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-53981},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-53981/}}
}