Vulnerability · Published Sep 10, 2024 · Assigned by GitHub_M

CVE-2024-45412Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack

Medium 5.3

In plain English

A medium-severity resource allocation without limits in yeti from yeti-platform. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.8%top 43.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial of service with attacks such as One Million Unicode payload. This can get worse with the use of special Unicode characters like U+2100 (℀), or U+2105 (℅) which could lead the payload size to be tripled. Versions prior to 2.1.11 are affected by this vulnerability. The patch is included in 2.1.11.

Affected products (as reported)

Vendor	Product	Versions
yeti-platform	yeti	< 2.1.11

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/yeti-platform/yeti/security/advisories/GHSA-cwwm-pq9x-2cxv x_refsource_CONFIRM
https://github.com/yeti-platform/yeti/commit/f1f0082e7c165f148ae95f4deeb2786404797a39 x_refsource_MISC
https://hackerone.com/reports/2258758 x_refsource_MISC