Summary
The TAXII 2.1 push endpoint (POST /taxii2/root/collections/:id/objects/) fully parses
the JSON request body before performing any authentication check. With a default body
limit of 50 MB, an unauthenticated attacker can force the server to deserialize up to
50 MB of JSON per request. Sending concurrent requests saturates CPU and heap memory,
degrading or denying service for all platform users with no credentials required.
Impact
- No credentials required: The attack surface is the public internet if the TAXII
port is exposed, or any internal network segment that can reach the platform.
- Service disruption: Repeated concurrent large-body requests exhaust Node.js heap,
causing the GraphQL API to become unresponsive for all users, connectors, and
automated ingestors.
- Rate limiting bypass: Any rate limiting applied at the application layer runs
post-auth and does not protect against unauthenticated pre-auth body parsing.
- Cloud cost amplification: On auto-scaling infrastructure, the attack triggers
unnecessary scale-out events increasing operational costs.
Summary
The TAXII 2.1 push endpoint (
POST /taxii2/root/collections/:id/objects/) fully parsesthe JSON request body before performing any authentication check. With a default body
limit of 50 MB, an unauthenticated attacker can force the server to deserialize up to
50 MB of JSON per request. Sending concurrent requests saturates CPU and heap memory,
degrading or denying service for all platform users with no credentials required.
Impact
port is exposed, or any internal network segment that can reach the platform.
causing the GraphQL API to become unresponsive for all users, connectors, and
automated ingestors.
post-auth and does not protect against unauthenticated pre-auth body parsing.
unnecessary scale-out events increasing operational costs.