Denial of Service via Attachment Upload in plankanban/planka

Valid

Reported on

Aug 3rd 2022


Description

An attacker can upload an attachment without any size limitation which leads to an exception and the crash of the application.

Proof of Concept

  1. 1 - Log in and select and project and card.
  2. 2 - Upload a file, in this case, a 5GB file. Used sample file.
  3. 3 - After some seconds the application crash's and restarts, as seen below. dos

Impact

Denial of service.

We are processing your report and will contact the plankanban/planka team within 24 hours. 4 months ago
We have contacted a member of the plankanban/planka team and are waiting to hear back 4 months ago
Maksim Eltyshev
4 months ago

Maintainer


I consider this issue as a bug and not a security issue. In SaaS product this would be a problem, but on self-hosted version this doesn’t make any sense.

vultza
4 months ago

Researcher


I fully comprehend your point, but I also consider this a security issue, not a major one of course, because it's possible to continuously send the described payload, which would cause the server to keep crashing and restarting, which clearly affects the availability of the application.

OWASP describes clearly in this post why an issue like this could be a security concern.

We have sent a follow up to the plankanban/planka team. We will try again in 7 days. 4 months ago
Maksim Eltyshev validated this vulnerability 4 months ago

I accept this because I didn't have a security policy on DoS vulnerabilities before.

vultza has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
We have sent a fix follow up to the plankanban/planka team. We will try again in 7 days. 4 months ago
We have sent a second fix follow up to the plankanban/planka team. We will try again in 10 days. 3 months ago
Maksim Eltyshev marked this as fixed in 1.7.2 with commit cece22 3 months ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
create.js#L42-L70 has been validated
to join this conversation