CVE-2023-49800 Denial of service by abusing `fetchOptions.retry` in nuxt-api-party

High 7.5 Published 8 Dec 2023 Updated 2 Aug 2024

Attackers can crash the server via stack overflow by abusing unfiltered retry options in the nuxt-api-party module.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-49800?

CVE-2023-49800 is a high-severity denial of service vulnerability in johannschopplich nuxt-api-party, published on 8 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directly from the request body. A malicious user can construct a URL known to not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively resulting in a denial of service. This issue has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should limit ofetch options.

Weakness: CWE-787, CWE-674, CWE-400

Which versions are affected by CVE-2023-49800?

2 open source packages ship an affected version, including nuxt-api-party. It affects 1 product.

Package	Affected	Fixed in
`nuxt-api-party` npm	All versions	`0.22.1`
`nuxt-api-party` npm	All versions	`0.22.1`

Products include Johannschopplich Nuxt Api Party.

How do I fix CVE-2023-49800?

Upgrade nuxt-api-party to 0.22.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-49800 being exploited?

There is no known exploitation of CVE-2023-49800 in the wild and no public exploit code.

CVE-2023-49799 Server-Side Request Forgery in nuxt-api-party High 7.5

Sources

Also known as GHSA-q6hx-3m4p-749h.