Apache Answer: Pixel Flood Attack by uploading the large pixel file

CVE-2024-22393 is an unrestricted upload of a dangerous file type vulnerability in Apache Answer, affecting versions through 1.2.1 [1][2]. The flaw allows an authenticated attacker to upload an image with excessively large pixel dimensions, causing the server to exhaust memory resources [1][2].

To exploit this vulnerability, an attacker must be a logged-in user with the ability to post content that includes image uploads [2]. The attack does not require any special privileges beyond standard user access, making it accessible to any authenticated user on the platform.

Successful exploitation leads to a denial-of-service condition, where the server runs out of memory and becomes unresponsive [1][2]. This can disrupt the availability of the Q&A platform for all users.

The Apache Answer project has released version 1.2.5, which fixes the issue by applying proper file upload restrictions [1][2]. Users are strongly recommended to upgrade to this version; no workarounds have been provided.