Listen to this Post
How the CVE Works
The vulnerability resides in the `ciphertextContainer.UnmarshalJSON` method within the Contrast Coordinator’s transit engine API (coordinator/internal/transitengineapi/crypto.go). This method is responsible for parsing incoming JSON requests that contain a ciphertext field in the format vault:vX:base64.... The function splits the string by colons, extracts the version, and base64-decodes the third component into a byte slice called fullCiphertext. It then unconditionally takes a 12‑byte prefix from this slice to use as the AES‑GCM nonce: c.nonce = fullCiphertext[:aesGCMNonceSize], where `aesGCMNonceSize` is a constant set to 12.
The critical flaw is the complete absence of a length check on `fullCiphertext` before this slicing operation. An attacker can supply a base64‑encoded payload that decodes to fewer than 12 bytes (any base64 string shorter than approximately 16 characters will do). When the slice expression is evaluated, Go’s runtime panics with runtime error: slice bounds out of range [:12] with length N. This panic occurs while the JSON body is still being parsed inside the request handler, before any cryptographic operations are performed.
The request handler is invoked from net/http‘s standard goroutine, and the panic is caught by the HTTP server’s recovery mechanism, which returns a 500 error to the client. However, the handler aborts mid‑execution, and the full panic stack trace is written to the Coordinator’s logs (stderr/journald). The connection is closed without a response body, and the request is recorded as failed in the Prometheus metrics.
Authentication is required but is trivially satisfied by any workload that holds a valid mesh certificate with a non‑empty `WorkloadSecretID` in its PolicyEntry. The `authorizationMiddleware` checks that the certificate’s `WorkloadSecretOID` extension matches the URL path’s `{name}` segment, a condition automatically met for any workload that has gone through the normal initializer flow. There is no rate limiting, no proof‑of‑work, and no audit log for triggering the panic.
An attacker with a valid workload identity can repeatedly send malformed ciphertexts to the `/v1/transit/decrypt/
DailyCVE Form
Platform: Contrast Coordinator
Version: All versions
Vulnerability: Panic Denial of Service
Severity: Low (CVSS 3.1)
Date: 2025-08-28
Prediction: Patch expected 2025-09-01
What Undercode Say
Analytics – The following commands and code snippets demonstrate how to reproduce and analyse the vulnerability:
Proof‑of‑Concept Test (Go unit test):
func TestCiphertextContainer_UnmarshalJSON_ShortBlobPanics(t testing.T) {
// "AAAA" base64-decodes to 3 bytes, well under aesGCMNonceSize=12.
body := []byte(<code>"vault:v1:AAAA"</code>)
defer func() {
if r := recover(); r == nil {
t.Fatalf("expected panic, got nil")
}
}()
var c ciphertextContainer
_ = c.UnmarshalJSON(body) // panics: slice bounds out of range [:12] with length 3
}
End‑to‑end curl command (against a running Coordinator):
curl -k --cert workload.crt --key workload.key \
-H 'Content-Type: application/json' \
-d '{"ciphertext":"vault:v1:AAAA","associated_data":""}' \
https://coordinator:8200/v1/transit/decrypt/<my-workload-secret-id>
Response: Connection closed without HTTP body.
Coordinator log: http: panic serving 10.0.0.5:54321: runtime error: slice bounds out of range [:12] with length 3
Log spam amplification loop:
while true; do
curl -k --cert workload.crt --key workload.key \
-H 'Content-Type: application/json' \
-d '{"ciphertext":"vault:v1:AAAA","associated_data":""}' \
https://coordinator:8200/v1/transit/decrypt/<workload-secret-id>
done
Exploit
An authenticated workload with a valid mesh certificate can exploit this vulnerability by sending a POST request to the transit‑engine decrypt endpoint with a `ciphertext` field that decodes to fewer than 12 bytes. The minimal payload is `”vault:v1:AAAA”` (base64 for 3 bytes). No special privileges are required beyond a standard workload identity; the path‑name authorisation is automatically satisfied for any workload secret ID assigned in the manifest. The attacker can repeat this request to generate continuous log spam, consume CPU for stack traces, and flood monitoring metrics with failed requests. The panic also leaks internal source paths and line numbers, which can be used to fingerprint the exact Coordinator version.
Protection
The recommended fix is to add a length validation before slicing. In coordinator/internal/transitengineapi/crypto.go, after base64 decoding, insert:
if len(fullCiphertext) < aesGCMNonceSize {
return fmt.Errorf("ciphertext is too short: got %d bytes, expected at least %d for the nonce", len(fullCiphertext), aesGCMNonceSize)
}
A defence‑in‑depth improvement would also reject ciphertexts with `len(fullCiphertext) <= aesGCMNonceSize` (which would result in an empty actual ciphertext). Additionally, a unit test should be added to assert that a clean error is returned rather than a panic. Until the patch is applied, operators can mitigate by implementing a reverse proxy or Web Application Firewall (WAF) rule that blocks requests where the `ciphertext` field contains a base64 blob shorter than ~16 characters, or by restricting access to the transit‑engine endpoint to only trusted workloads.
Impact
- Soft Denial of Service – The Coordinator remains running due to `net/http` panic recovery, but each malformed request consumes CPU for stack dumping and floods the operator’s logs with stack traces. This can overwhelm log storage and complicate monitoring.
- Information Disclosure – The panic stack trace reveals the Coordinator binary version, the build path of the `transitengineapi` package, and exact line numbers of internal source code. This low‑grade fingerprint can help an attacker identify the exact version of the Coordinator.
- Loss of Structured Error Reporting – Legitimate decrypt requests may be obscured by the log noise, and API clients receive a connection‑close instead of a meaningful 4xx error response, masking the true cause of failure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
