Lucene search

K
hackeroneOoooooo_qH1:2012125
HistoryJun 04, 2023 - 7:40 a.m.

Internet Bug Bounty: [CVE-2022-44572] Possible Denial of Service Vulnerability in Rack’s RFC2183 boundary parsing

2023-06-0407:40:02
ooooooo_q
hackerone.com
$480
28
denial of service
vulnerability
rack
rfc2183
cve-2022-44572
multipart parsing
redos
memoization
bug bounty

0.001 Low

EPSS

Percentile

39.8%

I reported at https://hackerone.com/reports/1639882

https://discuss.rubyonrails.org/t/cve-2022-44572-possible-denial-of-service-vulnerability-in-racks-rfc2183-boundary-parsing/82124
> There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572.
> Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

Impact

Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
This regular expression does not have the effect of ReDoS countermeasures using memoization in Ruby 3.2.