Quick answers
- Is CVE-2022-4111 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-4111 being exploited in the wild.
- How severe is CVE-2022-4111?
- Low severity, with a CVSS score of 3.1, published 22 November 2022.
- Which products and versions are affected?
- ToolJet before 1.27.0.
- Is there a fix for CVE-2022-4111?
- A patch was published on 2022-10-03: Fix merged in PR #4103 and released in version 1.27.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-4111 attacked?
- It is attacked over the network.
- Am I affected by CVE-2022-4111?
- Check whether you run ToolJet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
ToolJet failed to implement file size validation when processing user avatar uploads, allowing authenticated users to upload arbitrarily large files. The vulnerability is classified as improper resource exhaustion control (CWE-400) and missing validation of uploaded resources (CWE-1284). An authenticated attacker can exploit this by uploading multiple large files as user avatars, consuming storage and computational resources, resulting in denial of service. The fix, introduced in version 1.27.0 (commit 01cd3f0464747973ec329e9fb1ea12743d3235cc), adds a maximum file size validator to the user avatar upload functionality.
Affected products
- ToolJet ToolJet before 1.27.0
Identifiers
- CVE-2022-4111
- GHSA-hgp8-w8fj-r4cm
Timeline
- 2022-11-22: disclosed
- 2022-10-03: patched: Fix merged in PR #4103 and released in version 1.27.0