CowAgent /upload DoS: Memory Exhaustion via Unrestricted File Uploads

Vulnerability Overview CowAgent contains a denial of service (DoS) vulnerability in the workflow within its web console. This vulnerability allows an attacker to rapidly consume Python process memory, fill temporary workspace disk storage, create a large number of filesystem entries, and render the CowAgent service unavailable by uploading very large files or directories containing numerous files. If the uploaded files are subsequently attached to Agent messages, the attack can amplify downstream parsing, tool execution, and model/API costs. Affected Scope Vendor: CowAgent Affected Versions: - CowAgent commit: - Desktop package version: - Python package version: Verification Environment: - Local source tree: Vulnerable Files Vulnerability Description CowAgent's endpoint accepts both single file and directory uploads. It parses multipart form data and reads each uploaded file entirely into memory before writing it to disk. The endpoint does not enforce limits on individual file size, directory file count, or total upload size. Code Analysis Vulnerable Helper Function Constrained Helper Function Directory Upload Path Single File Upload Path Explicit Upload Limits for Knowledge Import Enforcing Limits Missing Invariant Low-trust uploads should be rejected before exceeding the configured per-file limit, rather than buffering the full multipart/file content. Proof of Concept (PoC) PoC Code Default PoC Behavior Submits a 12 MiB single file upload. This exceeds the 10 MiB per-file limit for knowledge import but remains small enough to ensure safe execution. Submits a directory upload containing 120 files, each 64 KiB in size. This exceeds the 100-file limit for knowledge import while keeping the total data volume small. Verifies that the general path accepts both types of uploads. Verifies that uploaded file objects are read using an unbounded method. Indicators of Successful Exploitation Why This Is Security-Relevant This issue is not merely a missing convenience limit. The vulnerable path applies no resource boundaries before processing attacker-controlled upload content. 1. Multipart form data is accepted without a general request size limit. 2. Single file uploads read the entire file into process memory. 3. Directory uploads iterate over all submitted files without an upper bound on file count. 4. Each directory file is fully read into memory before being written to disk. 5. There is no cumulative total size limit for directory batches. 6. Partial writes may leave disk residues if subsequent files fail. An attacker with access to the Web Console can exploit this vulnerability to exhaust memory or disk space, create excessive filesystem overhead, degrade service responsiveness, and potentially amplify later Agent/file processing costs. Remediation Recommendations 1. Enforce upload request limits before multipart parsing. - Check the header. - Reject missing or oversized bodies with HTTP 413. - Prefer shared web middleware so that all upload endpoints inherit the same protection. 2. Replace in the general path. - Use or a streaming copy helper function. - Reject the request when a file exceeds the configured per-file limit. 3. Add limits for directory uploads. - Maximum file count. - Maximum total byte size. - Maximum path length. - Maximum directory depth. - Maximum filename length. 4. Stream writes to disk and calculate cumulatively. - Read in fixed block sizes. - Calculate per-file and total byte counts during reading. - Stop immediately upon exceeding limits. - Remove partially written files/directories on failure. 5. Align general upload defaults with existing knowledge import limits. - For example: 100 files, 10 MiB per file, 200 MiB total, or a separate documented configuration section. 6. Add regression tests. - Files larger than the configured per-file limit should return 413. - Directories exceeding the configured directory file count limit should return 413. - Directory batches larger than the total size limit should return 413. - The upload handler must never call with an unbounded size. - Partially uploaded files must be deleted after rejection.

Goal Reached Thanks to every supporter — we hit 100%!

CowAgent /upload DoS: Memory Exhaustion via Unrestricted File Uploads

More from this source