Executive Summary

This vulnerability exists in PraisonAI versions prior to 4.5.128 in its WSGI-based recipe registry server (server.py). The server reads the entire HTTP request body into memory based on the client-supplied Content-Length header without any upper limit. Because authentication is disabled by default, any local process can send very large POST requests to the server.

This lack of limit allows an attacker to exhaust the server's memory by sending arbitrarily large requests, causing a denial of service. The Starlette-based server has a 10MB request size limit, but the WSGI server does not have such protection.

The issue is fixed in version 4.5.128.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows any local process to send arbitrarily large POST requests to the WSGI-based recipe registry server, causing a denial of service by exhausting server memory. However, there is no indication in the provided information that this vulnerability leads to unauthorized access, data leakage, or compromise of personal or sensitive data.

Since the vulnerability does not affect confidentiality or integrity of data but only availability, its impact on compliance with standards like GDPR or HIPAA—which primarily focus on protecting personal data privacy and security—is likely limited to availability requirements.

Denial of service incidents can affect availability requirements under these regulations, but without further details on data exposure or breach, the direct compliance impact cannot be fully determined from the provided information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the WSGI-based recipe registry server reading the entire HTTP request body into memory based on the client-supplied Content-Length header without an upper bound, allowing denial of service via large POST requests.

To detect exploitation attempts on your system or network, you can monitor for unusually large POST requests sent to the vulnerable server endpoints, especially those exceeding typical sizes.

Since authentication is disabled by default, any local process can send such requests, so monitoring local traffic or logs for large POST requests without authentication may help.

• Use network monitoring tools like tcpdump or Wireshark to capture HTTP POST requests and filter for large Content-Length headers.
• Example tcpdump command to capture HTTP POST requests with large Content-Length headers (e.g., over 10MB):
• tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) > 10485760)'
• Alternatively, inspect server logs for POST requests with large Content-Length values or memory exhaustion errors.

Note: The exact commands and detection methods depend on your environment and logging setup.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing any local process to cause a denial of service on the PraisonAI WSGI-based server. By sending very large POST requests, an attacker can exhaust the server's memory, making the service unavailable.

Since authentication is disabled by default, this attack can be performed without any credentials, increasing the risk.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade PraisonAI to version 4.5.128 or later where the issue is fixed.

Additionally, ensure that authentication is enabled and properly configured to prevent unauthorized local processes from sending large POST requests.

Consider implementing request size limits or other protections on the WSGI-based recipe registry server to prevent memory exhaustion.

Useful 0 Not Useful 0