Denial of Service in ZenML Affects Unauthenticated Users

CVE-2024-9340

What is CVE-2024-9340?

A Denial of Service (DoS) vulnerability exists in ZenML version 0.66.0, allowing unauthenticated attackers to trigger excessive resource consumption. By sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries, attackers can exploit flaws in the request processing mechanism. This results in an infinite loop that leads to a complete denial of service affecting all users. Key endpoints vulnerable to this attack include '/api/v1/login' and '/api/v1/device_authorization'.

References