Listen to this Post
The vulnerability resides in the improper state management of the `shareables` list within the `cbor2` library’s CBORDecoder. When a decoder instance is reused to process multiple, distinct CBOR messages, it fails to clear its internal `shareables` list between decode operations. This list stores values tagged with CBOR tag 28 (shareable), meant for internal reference within a single data item via tag 29 (sharedref). An attacker who can supply a subsequent CBOR message containing a `sharedref` tag (29) can reference indices in this persisted list, thereby reading values from a previously decoded message processed by the same decoder instance. This cross-message data access violates the value-sharing extension’s scope and leads to information disclosure. The bug exists in both the pure Python (cbor2/_decoder.py) and C extension (source/decoder.c) implementations, specifically in the `decode_from_bytes()` method and the `fp` setter, which change the input source without resetting the `shareables` state.
Platform: cbor2 Python library
Version: <= 5.4.7
Vulnerability: State leakage
Severity: Critical
date: 2024-04-17
Prediction: 2024-05-15
What Undercode Say:
pip show cbor2
import cbor2 from io import BytesIO msg1 = cbor2.dumps(cbor2.CBORTag(28, "secret")) msg2 = cbor2.dumps(cbor2.CBORTag(29, 0)) decoder = cbor2.CBORDecoder(BytesIO(b'')) decoder.decode_from_bytes(msg1) print(decoder.decode_from_bytes(msg2))
How Exploit:
Craft malicious CBOR message with `sharedref` tag referencing prior `shareable` data from a trusted message decoded by the same reused `CBORDecoder` instance.
Protection from this CVE
Update to cbor2>=5.4.8. Do not reuse `CBORDecoder` instances across untrusted message boundaries. Use separate decoder instances for each message source.
Impact:
Information disclosure of sensitive data (credentials, tokens, private data) from previously decoded messages when decoder is reused.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
