Listen to this Post
How the CVE Works
The vulnerability occurs in HAX CMS NodeJS when authenticated API requests to `listFiles` or `saveFiles` endpoints lack required URL parameters. The application fails to handle missing parameters, leading to an uncaught `ERR_INVALID_ARG_TYPE` exception. This crashes the NodeJS backend, causing a denial of service. The issue stems from improper input validation in `listFiles.js` (line 22) and `saveFile.js` (line 52), where user-supplied parameters are not checked before processing. Attackers exploit this by sending malformed requests, disrupting service availability.
DailyCVE Form
Platform: HAX CMS
Version: NodeJS
Vulnerability: DoS
Severity: Medium
Date: 2023-10-15
Prediction: Patch by 2023-12-01
What Undercode Say
curl -X POST http://target/system/api/listFiles -H "Authorization: Bearer TOKEN"
// Exploit snippet
fetch('/system/api/saveFile', { method: 'POST', headers: { 'Authorization': 'Bearer TOKEN' } });
How Exploit
Send malformed API requests to crash backend.
Protection from this CVE
Update to patched version.
Implement input validation.
Impact
Service disruption, downtime.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
