Software AG ARIS Lack of Rate Limiting in File Upload Functionality Allowing Resource Exhaustion

A denial-of-service vulnerability has been identified in Software AG ARIS versions through 10.0.23.0.3587512. The issue arises because the file upload feature does not implement any rate limiting or throttling, enabling users to upload files at an unrestricted pace. This lack of control can be exploited to quickly upload a large number of files, potentially causing resource exhaustion issues such as depleting disk space, increasing server load, or degrading overall performance.

Impact

Exploitation of this vulnerability can lead to denial-of-service conditions by causing resource exhaustion, such as filling up disk space, increasing server load, or degrading application performance.

Remediation

Users are advised to implement rate limiting on the file upload API. Instructions for updating to a fixed version can be found on the Software AG website.