Listen to this Post
The vulnerability exists in the `unfurl/parsers/parse_compressed.py` file. When processing compressed data embedded in URLs, the function `zlib.decompress(decoded)` is called without specifying a maximum output buffer size (lines 81-82). An attacker can craft a small, highly compressed payload of repetitive data (like all zeros) that expands to gigabytes upon decompression. This is a classic compression bomb attack. The server allocates memory for the entire decompressed output in one operation, leading to immediate memory exhaustion. Since the parsing occurs during URL analysis, the attack can be triggered remotely without authentication by submitting a malicious URL to the vulnerable endpoint (e.g., /json/visjs). The lack of a `bufsize` limit or streaming decompression allows a trivial denial-of-service condition.
Platform: Unfurl
Version: unspecified
Vulnerability: Decompression Bomb
Severity: Critical
date: unspecified
Prediction: No patch
What Undercode Say:
python3 security_poc/poc_decompression_bomb.py --generate-only --size 100
payload=$(base64 -w0 bomb.bin) && curl "http://target:5000/json/visjs?url=https://example.com/?data=$payload"
Vulnerable code snippet inflated_bytes = zlib.decompress(decoded)
Mitigated code snippet MAX_SIZE = 1010241024 inflated_bytes = zlib.decompress(decoded, bufsize=MAX_SIZE)
How Exploit:
Craft a malicious URL containing a base64-encoded zlib payload that decompresses to an extremely large size (e.g., 100MB+). Submit this URL to the Unfurl instance’s JSON API endpoint. The server will attempt to decompress the payload in memory, exhausting available RAM and causing a crash or severe service degradation.
Protection from this CVE
Implement decompression size limits. Use zlib.decompress(data, bufsize=MAX_SIZE). Employ streaming decompression with incremental size checks. Enforce strict URL length limits. Monitor for abnormal memory consumption patterns.
Impact:
Memory exhaustion leads to complete service denial. Remote unauthenticated attack vector. Potential for cloud cost inflation via resource consumption. Service crash and instability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
