Medium severity · published Dec 10, 2024
CVE-2024-55653
pwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS)
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
PwnDoc is a penetration test report generator. In versions up to and including 0.5.3, an authenticated user is able to crash the backend by raising a `UnhandledPromiseRejection` on audits which exits the backend. The user doesn't need to know the audit id, since a bad audit id will also raise the rejection. With the backend being unresponsive, the whole application becomes unusable for all users of the application. As of time of publication, no known patches are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PW
pwndoc · pwndoc
<= 0.5.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-55653
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-55653
Exploit
https://github.com/pwndoc/pwndoc/security/advisories/GHSA-ggqg-3f7v-c8rc
More from pwndoc
8.5
CVE-2024-55602
PenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path Traversal
8.1
CVE-2025-23044
Cross-Site Request Forgery (CSRF) allows creating admin account with POST request
6.5
CVE-2025-27410
PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin
6.5
CVE-2024-55652
PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filters
4.9
CVE-2025-27413
PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json
