CVE-2023-42457: plone.rest vulnerable to Denial of Service when ++api++ is used many times
Impact When the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive.
Patches Patches will be released in plone.rest 2.0.1 and 3.0.1. Series 1.x is not affected.
Workarounds In your frontend web server (nginx, Apache) you can redirect /++api++/++api++ to /++api++.
Other sources
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in plone.rest 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect /++api++/++api++ to /++api++ in one's frontend web server (nginx, Apache).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the impact of CVE-2023-42457?
When the `++api++` traverser is accidentally used multiple times in a URL, handling it takes increasingly longer, making the server less responsive.
How can plone.rest users be affected by CVE-2023-42457?
plone.rest users can be affected if they accidentally use the `++api++` traverser multiple times in a URL.
What is the severity of CVE-2023-42457?
CVE-2023-42457 has a severity rating of 7.5 (High).
What is the recommended remedy for CVE-2023-42457 in plone.rest?
For versions 2.x prior to 2.0.1 and 3.x prior to 3.0.1, upgrading to version 2.0.1 or 3.0.1 respectively is recommended.
Are there any references available for CVE-2023-42457?
Yes, you can find references for CVE-2023-42457 at the following links: [GitHub Advisory](https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-42457).