CVE-2025-57798 — The Title Input Functionality Due To A Lack Of Proper Length Denial of Service

title: Joplin Local API Excessive Title Length DoS — CVE-2025-57798
id: scw-2026-05-19-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2025-57798 by sending a POST request to the Joplin local API's /notes endpoint with a 'title' parameter. This vulnerability allows an attacker with a compromised authentication token to trigger a Denial of Service (DoS) by providing an excessively long string in the note's title, leading to an Out Of Memory (OOM) error. This rule specifically targets the API interaction method.
author: SCW Feed Engine (AI-generated)
date: 2026-05-19
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2025-57798/
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
    category: webserver
detection:
  selection:
      cs-method:
          - 'POST'
      cs-uri:
          - '/notes'
      cs-uri-query|contains:
          - 'title=' 
      # The actual exploit would involve a very long string for the 'title' parameter.
      # Sigma doesn't have a direct way to specify string length limits in a generic way.
      # This rule focuses on the specific API endpoint and method used for exploitation.
      # A more advanced rule might look for unusually large POST request bodies targeting this endpoint.
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse