Executive brief
ToolJet is a low-code application development platform that allows users to upload profile avatars. The application did not enforce limits on the file size of these uploads, allowing attackers with user accounts to exhaust storage or computational resources by uploading multiple large files, causing the service to become unavailable to legitimate users.
Technical details
ToolJet failed to implement file size validation when processing user avatar uploads, allowing authenticated users to upload arbitrarily large files. The vulnerability is classified as improper resource exhaustion control (CWE-400) and missing validation of uploaded resources (CWE-1284). An authenticated attacker can exploit this by uploading multiple large files as user avatars, consuming storage and computational resources, resulting in denial of service. The fix, introduced in version 1.27.0 (commit 01cd3f0464747973ec329e9fb1ea12743d3235cc), adds a maximum file size validator to the user avatar upload functionality.
Affected products
- ToolJet ToolJet before 1.27.0
Timeline
- 2022-11-22: disclosed
- 2022-10-03: patched: Fix merged in PR #4103 and released in version 1.27.0