Color Notes Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Color Notes version 1.4. This issue allows attackers to crash the application by pasting extremely long character strings into note fields. The vulnerability arises from the app's inability to handle excessive input, leading to a crash. Exploitation involves generating a payload of 350,000 repeated characters, which can be pasted twice into a new note, causing the application to become unresponsive.

Impact

Exploitation of this vulnerability causes the application to stop responding, effectively crashing it.

Reproduction

To reproduce this vulnerability, open Color Notes version 1.4 on iOS. Create a new note and run a Python script that generates a text file containing 350,000 repeated characters. Copy the contents of this file and paste it twice into the note. The application will crash, demonstrating the denial-of-service condition.