Summary
Untrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state.
Details
Untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service.
The code assumed to be responsible for this can be found here:
|
/// `Extensions::None`. |
|
#[inline(always)] |
|
fn parse_ttl_extension(s: &str) -> Extension { |
|
if let Ok(ttl) = s.parse::<u64>() { |
|
let start = SystemTime::now(); |
|
let timestamp = start |
|
.duration_since(UNIX_EPOCH) |
|
.map(|d| d.as_secs()) |
|
.unwrap_or(rand::random()); |
|
|
|
let time = timestamp - (timestamp % ttl); |
PoC
- Download and run the latest version of vproxy
- Send a cUrl request like the following, adjusting address and port as necessary:
curl -x "http://test-ttl-0:[email protected]:8101" https://google.com
- Wait for a cUrl error indicating "Proxy CONNECT aborted"
- View logs from the vproxy server
- Observe that the vproxy server crashed due to a divide-by-zero panic
Impact
The resulting crash renders the proxy server unusable until it is reset.
Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon)
bronallo-bd Reporter
Summary
Untrusted, user-controlled data from the HTTP Proxy-Authorization header can induce a denial of service state.
Details
Untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a username such as 'configuredUser-ttl-0'), the modulo operation 'timestamp % ttl' will cause a division by zero panic, causing the server to crash causing a denial-of-service.
The code assumed to be responsible for this can be found here:
vproxy/src/extension.rs
Lines 173 to 183 in ab304c3
PoC
curl -x "http://test-ttl-0:[email protected]:8101" https://google.comImpact
The resulting crash renders the proxy server unusable until it is reset.
Finally, one last note: I'm reporting this on behalf of another researcher at Black Duck. Credit for discovery should be attributed to David Bohannon (dbohannon)