CVE-2024-49767: Pallets Werkzeug resource exhaustion in multipart form parsing

Executive brief

Werkzeug is a widely used library for building Python web applications. A vulnerability in how it handles file uploads allows an attacker to send specially crafted requests that bypass memory limits, potentially leading to a denial-of-service by exhausting server resources. This could cause the affected web service to become slow or completely unavailable to legitimate users.

Technical details

A resource exhaustion vulnerability exists in Werkzeug's multipart/form-data parsing logic. An attacker can bypass the 'Request.max_form_memory_size' security setting by providing a specially crafted form body during a file upload request. This allows for uncontrolled memory consumption, potentially leading to a Denial of Service (DoS) condition. The vulnerability is reachable over the network without authentication or user interaction. While 'max_content_length' remains effective, users are advised to upgrade to Werkzeug 3.0.6 or Quart 0.20.0 to address the bypass.

Affected products

• Pallets Werkzeug >= 2.0.0rc1, <= 3.0.5
• Pallets Quart < 0.20.0

Timeline

• 2024-10-25: disclosed
• 2024-10-25: advisory
• 2024-10-25: patched

References

• https://api.github.com/users/defnull
• https://github.com/defnull
• https://api.github.com/users/defnull/gists%7B/gist_id%7D
• https://api.github.com/users/defnull/repos
• https://avatars.githubusercontent.com/u/62740?v=4
• https://api.github.com/users/defnull/events%7B/privacy%7D