CISA Thorium Stream Processing Divide-By-Zero Vulnerability

A divide-by-zero vulnerability has been identified in CISA Thorium, specifically in versions 1.1.0 prior to 1.1.1. This issue arises when a user sets the stream split size to zero, leading to a service crash. The vulnerability can be exploited by remote, authenticated attackers.

Impact

Exploitation of this vulnerability causes the service to crash, creating a denial-of-service condition.

Reproduction

To reproduce this vulnerability, send a request to the Thorium API 'get streams' endpoint with the split size parameter set to zero. This will trigger a divide-by-zero error, causing the service to panic and crash.

Remediation

Users can upgrade to CISA Thorium version 1.1.1 or later to address this vulnerability.