Impact
Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process.
Do note that the impact varies from site to site as various site settings like max_image_size_kb, max_attachment_size_kb and max_image_megapixels will determine the amount of resources used when creating an upload.
Patches
The issue is patched in the latest stable, beta and tests-passed version of Discourse.
Workarounds
Reduce max_image_size_kb, max_attachment_size_kb and max_image_megapixels as smaller uploads require less resources to process. Alternatively, client_max_body_size can be reduced in Nginx to prevent large uploads from reaching the server.
Impact
Without a rate limit on the POST /uploads endpoint, it makes it easier for an attacker to carry out a DoS attack on the server since creating an upload can be a resource intensive process.
Do note that the impact varies from site to site as various site settings like
max_image_size_kb,max_attachment_size_kbandmax_image_megapixelswill determine the amount of resources used when creating an upload.Patches
The issue is patched in the latest stable, beta and tests-passed version of Discourse.
Workarounds
Reduce
max_image_size_kb,max_attachment_size_kbandmax_image_megapixelsas smaller uploads require less resources to process. Alternatively,client_max_body_sizecan be reduced in Nginx to prevent large uploads from reaching the server.