CyberRota Analysis
AI-GeneratedApplications using DotVVM versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final are vulnerable to unauthorized file uploads, allowing attackers to exploit this weakness to fill application storage and potentially cause a denial of service. Organizations utilizing this framework for web applications should prioritize updating to the latest versions to mitigate this risk and enhance their security posture. Implementing the DotvvmConfiguration.Security.AuthorizeFileUpload setting can further restrict upload permissions and reduce exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload storage allow unauthenticated users to submit files directly to DotvvmFileUploadMiddleware without an X-DotVVM-UploadToken generated by the FileUpload component. An attacker can repeatedly upload files and fill application storage, causing denial of service. DotvvmConfiguration.Security.AuthorizeFileUpload can additionally restrict which users may upload files. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.