CVE-2023-32699 MeterSphere denial of service vulnerability

Medium 6.5 Published 30 May 2023 Updated 10 Jan 2025

Attackers can cause server resource exhaustion and denial of service by submitting excessively long passwords during login.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-32699?

CVE-2023-32699 is a medium-severity denial of service vulnerability in metersphere, published on 30 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

MeterSphere is an open source continuous testing platform. Version 2.9.1 and prior are vulnerable to denial of service. The `checkUserPassword` method is used to check whether the password provided by the user matches the password saved in the database, and the `CodingUtil.md5` method is used to encrypt the original password with MD5 to ensure that the password will not be saved in plain text when it is stored. If a user submits a very long password when logging in, the system will be forced to execute the long password MD5 encryption process, causing the server CPU and memory to be exhausted, thereby causing a denial of service attack on the server. This issue is fixed in version 2.10.0-lts with a maximum password length.

Weakness: CWE-770

Which versions are affected by CVE-2023-32699?

It affects 1 product.

Products include Metersphere Metersphere.

How do I fix CVE-2023-32699?

No fix has been published for CVE-2023-32699 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-32699 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-32699 exists.

Sources

Also known as GHSA-qffq-8gf8-mhq7.