PowerJob pre-auth request body caching can be exhausted by ordinary POST bodies

PowerJob paths such as /container/downloadContainerTemplate pass through a request-body caching filter before authentication. In the 1 GiB heap retest, a small number of large non-form request bodies triggered target JVM OOM.

Technical Details

• Trigger shape: Send large POST bodies with a non-form, non-multipart Content-Type to /container/downloadContainerTemplate.
• Root cause summary: CachingRequestBodyFilter copies the full body into String/StringBuilder/byte[] before authentication, while ordinary JSON/text/raw bodies are not constrained by multipart limits.
• Exploitation conditions: The entry is anonymous or pre-auth reachable, and non-multipart/form bodies are not limited by the server or proxy.
• Static source: Any Spring MVC request with Content-Type not exactly application/x-www-form-urlencoded or multipart/form-data, including anonymous /openApi/* and /container/downloadContainerTemplate
• Static sink: CachingRequestBodyFilter.CustomHttpServletRequestWrapper reads the full body into StringBuilder/String and later body.getBytes()

Suggested Remediation

• Add hard limits for request body size, object count, topic/job/key cardinality, queue length, active thread count, or aggregate retained bytes at the vulnerable entry.
• Enforce authentication and quota checks before expensive body reads, decompression, JSON/protobuf parsing, image rendering, task creation, or state retention.
• Add per-IP, per-user, per-token, or per-client rate and resource quotas for anonymous or low-privilege entries.
• Return 400/413/429 as early as possible and avoid retaining complete request bodies, payloads, or incomplete protocol state after rejection.