CVE-2024-9358 ThingsBoard HTTP RPC API resource consumption
Remote attackers can cause resource exhaustion in ThingsBoard via the HTTP RPC API, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9358?
CVE-2024-9358 is a medium-severity denial of service vulnerability in ThingsBoard, published on 1 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability has been found in ThingsBoard up to 3.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component HTTP RPC API. The manipulation leads to resource consumption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.7.1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was informed on 2024-07-24 about this vulnerability and announced the release of 3.7.1 for the second half of September 2024.
Weakness: CWE-400
Which versions are affected by CVE-2024-9358?
It affects 1 product.
Products include Thingsboard Thingsboard.
How do I fix CVE-2024-9358?
No fix has been published for CVE-2024-9358 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-9358 being exploited?
There is no known exploitation of CVE-2024-9358 in the wild and no public exploit code.
Other vulnerabilities in ThingsBoard
Sources
Also known as GHSA-wgr5-rw77-5f6p.