ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2024-31217

Denial-of-Service via Improper Exception Handling

Published Jun 12, 2024 · catalog updated Jun 12, 2024 · Denial-of-Service via Improper Exception

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2024-31217. EPSS is 0.74%. Act only if a listed version of Denial-of-Service via Improper Exception is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Denial-of-Service via Improper Exception).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.74%
Remediation
Version ranges on file
Affected products
cpe strapi/strapi · npm @strapi/plugin-upload

### Summary A Denial-of-Service was found in the media upload process causing the server to crash without restarting, affecting either development and production environments. ### Details Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the server execution, making it unavailable for any clients until it's manually restarted. ### PoC Due to a bug in what we believe to be Burp’s decoding system, we couldn’t produce a valid file to easily reproduce the vulnerability. Instead, the issue can be reproduced by following these steps: 1. Configure Burp’s proxy between a browser and a Strapi server 2. Log in and upload an image through the Media Library page while having Burp’s interceptor turned on 3. After capturing the upload POST request in Burp, add at the end of the file extension from the , in the filename parameter (See reference image 1 below) 4. Using the cursor, select the added and right-click it. Click in Convert selection > URL > URL decode to transform the selected text into a null byte 5. Forward the modified request. The server should print an error and crash with the error (See reference log 1 below) By following the data flow, we reached the [line of code](https://github.com/strapi/strapi/blob/f1dd5cc8eef574bac6679aab6f93276e57497328/packages/providers/upload-local/src/index.ts#L86) where we believe the DoS is being caused. The simpler way of fixing this vulnerability seems to be avoiding the error thrown by whitelisting the characters used in the extension. #### Reference Image 1 ![image](https://github.com/strapi/strapi/assets/8593673/c95278a1-1727-485e-b6f8-276074d9dd42) #### Reference Log 1 ### Impact Denial-of-Service occurs when a service becomes unavailable for users or other services. By sending a specially-crafted request, the server crashes without restarting. The entire server crashes with the thrown error instead of crashing only the single request and returnin

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe strapi/strapi< 4.22.0
  • npm @strapi/plugin-upload<=4.21.0

How to fix CVE-2024-31217

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2024-31217. EPSS is 0.74%. Act only if a listed version of Denial-of-Service via Improper Exception is installed.

Which versions are affected?

Compare what you have installed with < 4.22.0, <=4.21.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-248. EPSS 0.74%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Strapi security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 12, 2024 · Maintainer security tabs

    Detected

    ### Summary A Denial-of-Service was found in the media upload process causing the server to crash without restarting, affecting either development and production environments. ### Details Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the server execution, making it unavailable for any clients until it's manuall

Sources

  • CVE.orgVulnerability recordCVE-2024-31217

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2024-31217

    30-day exploitation probability 0.74%

    first.org
  • Maintainer security tabsVendor advisoryGHSA-pm9q-xj9p-96pm

    ### Summary A Denial-of-Service was found in the media upload process causing the server to crash without restarting, affecting either development and production environments. ### Details Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the server execution, making it unavailable for any clients until it's manuall

    github.com
  • Monitored products — highVendor advisoryCVE-2024-31217

    Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the server

    nvd.nist.gov

References

Freshness

Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 4, 2026
  • Monitored products — highNov 4, 2026
  • CVE.orgNov 2, 2026
  • Maintainer security tabsNov 1, 2026