Denial of Service via Attachment Upload in plankanban/planka

Valid

Reported on

Aug 3rd 2022

Description

An attacker can upload an attachment without any size limitation which leads to an exception and the crash of the application.

Proof of Concept

1 - Log in and select and project and card.
2 - Upload a file, in this case, a 5GB file. Used sample file.
3 - After some seconds the application crash's and restarts, as seen below.

Impact

Denial of service.

Occurrences

create.js L42-L70

We are processing your report and will contact the plankanban/planka team within 24 hours. a year ago

We have contacted a member of the plankanban/planka team and are waiting to hear back a year ago

Maksim Eltyshev

commented a year ago

Maintainer

I consider this issue as a bug and not a security issue. In SaaS product this would be a problem, but on self-hosted version this doesn’t make any sense.

vultza

commented a year ago

Researcher

I fully comprehend your point, but I also consider this a security issue, not a major one of course, because it's possible to continuously send the described payload, which would cause the server to keep crashing and restarting, which clearly affects the availability of the application.

OWASP describes clearly in this post why an issue like this could be a security concern.

We have sent a follow up to the plankanban/planka team. We will try again in 7 days. a year ago

Maksim Eltyshev validated this vulnerability a year ago

I accept this because I didn't have a security policy on DoS vulnerabilities before.

vultza has been awarded the disclosure bounty

The fix bounty is now up for grabs

The researcher's credibility has increased: +7

We have sent a fix follow up to the plankanban/planka team. We will try again in 7 days. a year ago

We have sent a second fix follow up to the plankanban/planka team. We will try again in 10 days. a year ago

Maksim Eltyshev marked this as fixed in 1.7.2 with commit cece22 a year ago

The fix bounty has been dropped

This vulnerability will not receive a CVE

create.js#L42-L70 has been validated

to join this conversation

We are processing your report and will contact the plankanban/planka team within 24 hours. a year ago

We have contacted a member of the plankanban/planka team and are waiting to hear back a year ago

Maksim Eltyshev

commented a year ago

Maintainer

I consider this issue as a bug and not a security issue. In SaaS product this would be a problem, but on self-hosted version this doesn’t make any sense.

vultza

commented a year ago

Researcher

OWASP describes clearly in this post why an issue like this could be a security concern.

We have sent a follow up to the plankanban/planka team. We will try again in 7 days. a year ago

Maksim Eltyshev validated this vulnerability a year ago

I accept this because I didn't have a security policy on DoS vulnerabilities before.

vultza has been awarded the disclosure bounty

The fix bounty is now up for grabs

The researcher's credibility has increased: +7

We have sent a fix follow up to the plankanban/planka team. We will try again in 7 days. a year ago

We have sent a second fix follow up to the plankanban/planka team. We will try again in 10 days. a year ago

Maksim Eltyshev marked this as fixed in 1.7.2 with commit cece22 a year ago

The fix bounty has been dropped

This vulnerability will not receive a CVE

create.js#L42-L70 has been validated

to join this conversation