Denial of Service in aimhubio/aim

Vulnerability

Description

In version 3.25.0 of aimhubio/aim, the tracking server overrides the maximum size for websocket messages, allowing very large images to be tracked. This design flaw enables an attacker—without any authentication requirement implied by the description—to send oversized image payloads through the websocket connection, forcing the server into a blocked state while processing the large image [2].

Exploitation

Prerequisites

No special privileges or network position beyond being able to reach the websocket endpoint are needed; the server accepts arbitrary image sizes because the size limit is deliberately overridden. An attacker simply sends a crafted message containing an extremely large image, which the server begins to process synchronously or in a way that monopolizes resources [2].

Impact

While the server processes the oversized image, it stops responding to other legitimate requests, resulting in a denial of service condition. The vulnerability does not require any special authentication or prior access, making it trivially exploitable by anyone who can connect to the Aim tracking server [1][2].

Mitigation

Status

As of the publication date (2025-03-20), the vulnerability is present in version 3.25.0. Users should check for updated releases or patches from the maintainers; the official repository is available at GitHub [1]. No workaround is described in the provided references.