Resource Exhaustion in StoaChat Delta via Message Limit Bypass

Executive Summary

This vulnerability is in stoa-chat (delta) versions before 20250210-1 (0.8.2). It involves a logic error in the query messages route where fetching messages nearby another message can set a message limit of zero. The database interprets zero as no limit, allowing an attacker to download an entire channel's message history in one request. Multiple such requests can cause denial of service by exhausting server resources.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusually high database query loads or excessive message fetch requests. Check for requests with a 'nearby' parameter that may bypass normal limits. Inspect server logs for patterns of large data downloads from single requests.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to overload your server by repeatedly downloading large amounts of message data, causing slowdowns or crashes. This disrupts normal operations and may lead to downtime for your chat service.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability by allowing denial of service through resource exhaustion. While it does not directly expose or leak data, the resource exhaustion could lead to service disruptions that may affect compliance with availability requirements in standards like GDPR (Article 32) and HIPAA (Security Rule). However, the vulnerability itself does not directly violate data protection requirements unless it results in prolonged unavailability of critical systems handling personal or health data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade stoatchat (delta) to version 20250210-1 (0.8.2) or later. Implement rate limiting on message fetch endpoints. Configure database query limits to enforce maximum results per request. Block or monitor for requests with zero or unusually high limits.

Useful 0 Not Useful 0