VisiCut Stack Consumption Vulnerability Leading to Denial-of-Service

A stack consumption vulnerability has been identified in VisiCut version 2.1, allowing for a denial-of-service condition. This issue arises from insecure deserialization of XML documents containing nested set elements. Exploitation of this vulnerability can be demonstrated by using a specific reference that triggers a StackOverflowError.

Impact

Exploitation of this vulnerability causes a stack overflow, leading to a denial-of-service condition where the application crashes and cannot be used until restarted.

Reproduction

To reproduce this vulnerability, create an XML document with nested set elements. Include a set element that references 'set[2]' to trigger the vulnerability. Save this XML file in a folder named 'settings', and compress the folder into a zip file. Then, upload the zip file using the 'FromFile' option in the VisiCut application.