CVE-2023-52075 ReVanced API vulnerable to Denial of Service due to lack of error caching
Attackers can trigger rate limits and increase server load, causing denial of service for all users of the ReVanced API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-52075?
CVE-2023-52075 is a high-severity denial of service vulnerability in revanced-api, published on 27 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ReVanced API proxies requests needed to feed the ReVanced Manager and website with data. Up to and including commit 71f81f7f20cd26fd707335bca9838fa3e7df20d2, ReVanced API lacks error caching causing rate limit to be triggered thus increasing server load. This causes a denial of service for all users using the API. It is recommended to implement proper error caching.
Weakness: CWE-755
Which versions are affected by CVE-2023-52075?
It affects 1 product.
Products include Revanced Revanced.
How do I fix CVE-2023-52075?
No fix has been published for CVE-2023-52075 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-52075 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-52075 exists.
Sources
Also known as GHSA-852x-grxp-8p3q.