Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input

CVE-2023-37279

What is CVE-2023-37279?

The Faktory web dashboard, designed for managing background jobs, is susceptible to a denial of service attack when manipulated through a crafted URL query parameter named 'days'. This vulnerability arises from the backend's improper handling of the 'days' parameter, which lacks validation. When a large value is submitted, it can consume excessive memory resources, leading to a crash of the backend server. This issue has been addressed in Faktory version 1.8.0, where the handling of the 'days' parameter has been fortified to prevent such attacks.

References