Possible DOS by overloading the TempFileResource

Issue:	SI-65
Date:	Aug 17, 2022, 1:45:00 PM
Severity:	Low
Requires Admin Access:	No
Fix Version:	22.10+, LTS 21.06.12+, LTS 22.03.4+
Credit:	Fortinet / Thanh Nguyen Nguyen
Description:	It is possible to call the TempFileResource multiple times, each time requesting the dotCMS server to download a large file. If done enough repeatedly, this will result in the Tomcat Request Thread pool to be exhausted and ultimately a denial of any other requests. This vulnerability was introduced in dotCMS version 5.2.0. Users of versions before that are not affected by this vulnerability report.
Mitigation:	Upgrade to one of the versions of dotCMS listed above: 22.10 LTS 21.06.12 LTS 22.03.4 Set TEMP_RESOURCE_ALLOW_ANONYMOUS=false Use a WAF to prevent POSTs to the /api/v1/temp/byUrl endpoint
References	CVE-2022-37034

Highly Rated and Recommended