CVE-2024-31992: GHSL-2023-225, GHSL-2023-226, GHSL-2023-227, and GHSL-2023-228: Server-Side Request Forgery (SSRF) and Denial of Service (DoS) in Mealie - CVE-2024-31991, CVE-2024-31992, CVE-2024-31993, CVE-2024-31994
Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safescrapehtml function utilizes a user-controlled URL to issue a request to a remote server, however these requests are not rate-limited. While there are efforts to prevent DDoS by implementing a timeout on requests, it is possible for an attacker to issue a large number of requests to the server which will be handled in batches based on the configuration of the Mealie server. The chunking of responses is helpful for mitigating memory exhaustion on the Mealie server, however a single request to an arbitrarily large external file (e.g. a Debian ISO) is often sufficient to completely saturate a CPU core assigned to the Mealie container. Without rate limiting in place, it is possible to not only sustain traffic against an external target indefinitely, but also to exhaust the CPU resources assigned to the Mealie container. This vulnerability is fixed in 1.4.0.
Other sources
Mealie v1.0.0-RC1.1 is vulnerable to multiple SSRF and DoS vulnerabilities. These vulnerabilities can be leveraged to identify, map, and retrieve the contents of webservers on Mealie’s local network as well as being the victim of, or launching point for, a denial of service attack against a target of the attacker’s choice.
— GitHub Security Lab
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31992?
CVE-2024-31992 is considered to be a moderate severity vulnerability due to its potential for denial-of-service attack when handling user-controlled URLs.
How do I fix CVE-2024-31992?
To fix CVE-2024-31992, upgrade Mealie to version 1.4.0 or later where the vulnerability has been addressed.
What does CVE-2024-31992 affect?
CVE-2024-31992 affects versions of Mealie prior to 1.4.0, specifically the implementation of the safe_scrape_html function.
What type of vulnerability is CVE-2024-31992?
CVE-2024-31992 is a denial-of-service vulnerability that arises from insufficient rate limiting on requests made to a remote server.
Who is impacted by CVE-2024-31992?
Users of Mealie versions prior to 1.4.0 are impacted by CVE-2024-31992 as their deployments may be exploited for denial-of-service attacks.