Description

CVE-2024-25978 describes a denial-of-service vulnerability resulting from insufficient file size checks in the file picker's unzip functionality. This allows a malicious actor to craft a specially designed archive that, when processed, could exhaust system resources, leading to a denial of service. While the CVSS score is 7.5 (High), indicating a significant risk, the SOCRadar Vulnerability Risk Score (SVRS) is 30.

Key Insights

• Denial of Service Impact: The primary impact is a denial-of-service (DoS) condition. Attackers can exploit the vulnerability to make the affected system or service unavailable to legitimate users.
• CWE-400 (Uncontrolled Resource Consumption): The vulnerability is classified as CWE-400, indicating that the software does not properly restrict the consumption of resources, allowing an attacker to exhaust available resources.
• Low SVRS: The SVRS of 30 suggests SOCRadar threat intelligence hasn't observed widespread exploitation.
• In The Wild: The vulnerability is actively exploited by hackers.

Mitigation Strategies

1. Patch Application: Immediately apply the security patch or update provided by the vendor that addresses the insufficient file size check. This is the most effective way to remediate the vulnerability.
2. Input Validation: Implement robust input validation checks on file sizes before processing them within the unzip functionality. Set reasonable upper limits on file sizes to prevent resource exhaustion.
3. Resource Monitoring: Implement and monitor resource usage (CPU, memory, disk I/O) on systems where the file picker's unzip functionality is used. Establish alerts for unusual resource spikes that could indicate an ongoing attack.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.