漏洞标题
通过滥用`fetchOptions.retry`在nuxt-api-party中拒绝服务
漏洞描述信息
`nuxt-api-party` 是一个开源模块，用于代理 API 请求。该库允许用户将许多选项直接发送到 `ofetch`。没有对可用选项进行筛选。我们可以滥用重试逻辑，导致服务器从栈溢出崩溃。fetchOptions 直接从请求体获取。恶意用户可以构造一个已知无法成功下载的 URL，然后将重试次数设置为高值，这样会导致 `ofetch` 错误处理递归导致拒绝服务。这个问题已在 0.22.1 版本中解决。建议用户升级。无法升级的用户应限制 `ofetch` 选项。
CVSS信息
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞类别
未经控制的递归
漏洞标题
Denial of service by abusing `fetchOptions.retry` in nuxt-api-party
漏洞描述信息
`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directly from the request body. A malicious user can construct a URL known to not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively resulting in a denial of service. This issue has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should limit ofetch options.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞类别
未经控制的递归
漏洞标题
nuxt-api-party 代码问题漏洞
漏洞描述信息
nuxt-api-party是Johann Schopplich个人开发者的一个开源模块，用于代理API请求。 nuxt-api-party 0.21.3及版本存在代码问题漏洞，该漏洞源于允许用户滥用重试逻辑，导致服务器因堆栈溢出而崩溃。
CVSS信息
N/A
漏洞类别
代码问题