Listen to this Post
This vulnerability resides within the Quarkus RESTEasy Reactive (or REST) HTTP layer’s response writing mechanism. When the framework sends a streamed or chunked HTTP response, it enters a blocking state to wait for acknowledgment that previous data chunks have been successfully written to the network channel. This waiting period creates a critical window. If the HTTP client (e.g., a browser or attacking tool) abruptly terminates the underlying TCP connection during this precise window, the framework’s error handling fails to proceed correctly. The I/O worker thread responsible for that specific request becomes stuck in an indefinite blocked state, perpetually waiting for a write completion signal that will never arrive. It cannot process new requests or be returned to the worker thread pool. By repeatedly triggering this condition—sending requests and then immediately resetting the client connection—an attacker can systematically deplete the application’s available worker threads. Since Quarkus relies on a finite pool of these threads to handle all incoming traffic, exhaustion leads to a progressive degradation of service and ultimately a complete denial-of-service (DoS) condition where the application can no longer respond to legitimate requests.
Platform: Quarkus
Version: <=3.20.0
Vulnerability: Thread Blocking DoS
Severity: Critical
Date: 2024-07-15
Prediction: Expected patch date: 2024-07-19
What Undercode Say:
`$ netstat -tn | grep :8080 | grep -i close_wait`
`$ curl -X POST http://target:8080/data –data-binary @largefile –max-time 1`
`$ for i in {1..1000}; do timeout 0.5s curl -s http://target:8080/api/stream & done`
`// Health check endpoint monitoring thread pool`
`@Liveness`
`@Path(“/health/threads”)`
`public class ThreadHealth implements HealthCheck {`
` @Inject ManagedExecutor executor;`
` public HealthCheckResponse call() {`
` int activeThreads = …;`
` if (activeThreads > THRESHOLD) { return HealthCheckResponse.down(“Threads exhausted”); }`
` }`
`}`
How Exploit:
- Attacker sends HTTP request to endpoint that streams a response.
- Attacker immediately resets (RST) the TCP connection after the first chunk is sent.
3. The server worker thread blocks permanently.
- Repeat steps 1-3 to exhaust the thread pool.
Protection from this CVE
Update to Quarkus >=3.20.1.
Implement thread pool monitoring.
Configure timeouts aggressively.
Impact:
Denial of Service.
Performance degradation.
Application unavailability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
