Listen to this Post
The HAPI FHIR library’s implementation of the Smart Health Card (SHC) parser is vulnerable to a denial-of-service condition through a specially crafted JWT. The vulnerability resides in `SHCParser.java` within the `org.hl7.fhir.r5` module. When a JWT header includes "zip": "DEF", the parser attempts to inflate the payload using the `inflate()` method. However, this method contains an unsafe loop that only checks `!inflater.finished()` and fails to verify inflater.needsInput(), inflater.needsDictionary(), or whether any output was produced.
If an attacker submits a JWT with a valid `zip: “DEF”` header but an empty or truncated DEFLATE payload, `Inflater.inflate()` will return 0 bytes, while `finished()` remains false and `needsInput()` becomes true. This creates an infinite tight loop, permanently consuming the thread. The same flawed loop pattern also exists in the `decompress()` method at lines 410-423. The validator triggers this code path during SHC validation and during file-format detection for SHC-looking input, as referenced in ResourceChecker.java:115-118. This means any service that accepts and validates SHC content is susceptible to worker-thread exhaustion through a single malformed request.
DailyCVE Form
Platform: HAPI FHIR
Version: r5
Vulnerability: Infinite Loop DoS
Severity: Critical
date: immediate
Prediction: Unknown
What Undercode Say
Analytics
Compile the HAPI FHIR project mvn clean install Run a minimal local harness that calls the vulnerable method timeout 3s java -cp target/classes VerifyDoSFindings shcHang echo $? 124 = timeout killed the hung process
// SHCParser.java:300-302
if ("DEF".equals(res.header.asString("zip"))) {
payloadJson = inflate(payloadJson);
}
// SHCParser.java:455-468
while (!inflater.finished()) {
final int count = inflater.inflate(buffer);
outputStream.write(buffer, 0, count);
}
Exploit: (Educational Purposes!)
Craft a JWT with:
- Header: `Base64URL({“zip”:”DEF”})`
– Payload: empty or truncated raw DEFLATE bytes - Signature: arbitrary
Submit the resulting token as SHC content via a `.shc` file or content beginning with `shc:/` that reaches the validator’s SHC detection path.
Protection
- Implement a check for `inflater.needsInput()` and `inflater.needsDictionary()` inside the inflation loop.
- Add a timeout or maximum iteration limit to the inflation loop.
- Validate that the DEFLATE payload is non-empty and well-formed before inflation.
- Use a streaming decompression approach that rejects incomplete data.
Impact
This is a denial-of-service vulnerability. A single malformed SHC validation request can consume a worker thread indefinitely. In services that validate uploaded SHC content, a small number of concurrent malformed requests can exhaust all validation workers.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
