Executive brief
Apostrophe is a popular Node.js content management framework used to build web applications. A flaw in its job scheduling module allows an attacker to exhaust server memory by accumulating uncleared callbacks, causing the application to become unresponsive or crash and disrupting service for all users.
Technical details
The apostrophe-jobs module fails to clear callbacks after jobs complete, leading to unbounded callback accumulation in server memory (CWE-400: Uncontrolled Resource Consumption). An attacker can trigger a large number of jobs through the network, each leaving a callback in memory, until the application exhausts available RAM and crashes. The vulnerability affects all versions prior to 2.97.1 and is fixed in version 2.97.1 and later. No authentication or special privileges are required to trigger job creation.
Affected products
- Apostrophe Apostrophe before 2.97.1
Timeline
- 2020-09-03: disclosed