Listen to this Post
The vulnerability exists in the `identity.extractIssuerURL` function of the affected library. This function processes untrusted OIDC identity tokens from incoming requests. It uses the Go `strings.Split` function to parse the token’s issuer URL by separating it at period (‘.’) characters. When a malicious actor supplies a crafted token consisting of a very long string containing thousands of periods, each call to `strings.Split` generates a slice containing all the substrings between those periods. This results in a massive number of heap allocations, proportional to the length of the input (O(n)). With a constant factor of ~16 bytes per substring, a single request with a multi-megabyte payload can trigger gigabytes of memory allocation, leading to rapid resource exhaustion and a denial-of-service condition for the application.
Platform: Go go-oidc library
Version: < 3.15.0
Vulnerability: DoS via token
Severity: Medium
date: 2024-05-30
Prediction: 2024-06-14
What Undercode Say:
curl -H "Authorization: Bearer $(python3 -c "print('.' 1000000)")" $TARGET_URL
// Vulnerable function pattern
func extractIssuerURL(token string) string {
parts := strings.Split(token, ".") // Excessive allocations on many '.'
// ... processing
}
How Exploit:
An attacker sends an HTTP request with a crafted, invalid OIDC `id_token` in the `Authorization` header. The token payload is a long string filled with period (‘.’) characters (e.g., “aaaaaaaa.bbbbbbbb.ccccccc…”). The library’s parsing function splits this entire string, allocating memory for each fragment between the periods, which can exhaust the server’s available memory and crash the process or severely degrade service.
Protection from this CVE:
Update to v3.15.0+. Implement input size limits. Use validated OIDC libraries.
Impact:
Memory exhaustion, application crash, denial-of-service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
