CVE-2024-54730
Published: 14 January 2025
Summary
CVE-2024-54730 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-54730 is a denial-of-service vulnerability in Flatnotes versions prior to 5.3.1, specifically exploitable through the upload image function. This issue, linked to CWE-400 (Uncontrolled Resource Consumption), carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its high severity due to significant availability impact with no effects on confidentiality or integrity.
A remote attacker requires no authentication or privileges and can exploit the vulnerability over the network with low complexity and no user interaction. Successful exploitation results in a denial of service, potentially disrupting the Flatnotes web server.
Mitigation involves upgrading to Flatnotes version 5.3.1 or later. Further details on the vulnerability and remediation are documented in the GitHub issue at https://github.com/dullage/flatnotes/issues/259 and the CVE advisory at https://github.com/Startr4ck/CVE_lists/blob/main/flatnotes/flatnotes%20webserver%20dos.md.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52657
Vulnerability details
Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote unauthenticated exploitation of a public-facing web app (T1190) via image upload to trigger uncontrolled resource consumption, directly causing application DoS (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific flaw in Flatnotes upload image function by requiring timely patching to version 5.3.1 or later.
Implements denial-of-service protections such as rate limiting and resource throttling to counter uncontrolled resource consumption via unauthenticated image uploads.
Enforces validation of uploaded image inputs for size, format, and content to prevent resource exhaustion from malformed or oversized files.