Frogbot demo #18
Frogbot demo #18
Conversation
|
📦 Vulnerable Dependencies✍️ Summary
🔬 Research Details[ CVE-2023-6378 ] ch.qos.logback:logback-core 1.2.11Description: [ CVE-2023-6378 ] ch.qos.logback:logback-classic 1.2.11Description: [ CVE-2024-34750 ] org.apache.tomcat.embed:tomcat-embed-core 9.0.63Description: During an The Apache HTTP Server must have the [ CVE-2024-22262 ] org.springframework:spring-web 5.3.20Description:
In the vulnerable example above, the host that will be returned by It is important to note that a host that ends with a backslash (e. .g. [ CVE-2024-22259 ] org.springframework:spring-web 5.3.20Description:
In the vulnerable example above, the host that will be returned by [ CVE-2024-22243 ] org.springframework:spring-web 5.3.20Description:
In the vulnerable example above, the host that will be returned by [ CVE-2023-46589 ] org.apache.tomcat.embed:tomcat-embed-core 9.0.63Description: A specially crafted trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. For example sending following request - would cause Tomcat to interpret the request as two separate requests, and return two separate responses. [ CVE-2023-44487 ] org.apache.tomcat.embed:tomcat-embed-core 9.0.63Description: HTTP/2 is a modern network protocol designed to improve the performance and efficiency of web communication. It replaces the older HTTP/1.1 protocol and introduces features like header compression and enhanced request cancellation mechanisms, which collectively enhance the speed and responsiveness of websites. This request cancellation mechanism allows clients to terminate unnecessary or redundant requests without waiting for a server's response, reducing network congestion and further improving the overall responsiveness of web applications. HTTP/2 resolves numerous concerns found in HTTP/1.1 by organizing each HTTP message into a series of HTTP/2 frames. These frames include type, length, flags, stream identifier (ID), and payload. The stream ID is essential in clearly associating specific bytes on the network with their corresponding messages, facilitating secure multiplexing and concurrent processing. These streams are bidirectional, enabling clients to transmit frames, and servers to respond with frames using the same ID. As detailed in this technical analysis, there's a vulnerability in the way request cancellation is implemented. The flaw lies in the process of sending an excessive number of requests (specifically, A lot of server applications are vulnerable to the Http/2 Rapid Reset attack. Remediation: Deployment mitigationsA possible mitigation is to limit the maximum number of requests that can be made over a single keep-alive connection. Deployment mitigationsFor NGINX: Disabling HTTP/2 in NGINX is not necessary. Simply ensure you have configured:
Development mitigationsFor Nghttp2: #include <nghttp2/nghttp2.h>
// Callback function for handling frame reception
int on_frame_recv_callback(nghttp2_session* session,
const nghttp2_frame* frame, void* user_data) {
// Check if the received frame is an RST_STREAM frame
if (frame->hd.type == NGHTTP2_RST_STREAM) {
// Increment a counter for RST_STREAM frames
int* rst_stream_counter = (int*)user_data;
(*rst_stream_counter)++;
// Define a threshold for excessive RST_STREAM frames
int rst_stream_threshold = 10; // Adjust this value as needed
// If the threshold is exceeded, take action (e.g., close the connection)
if (*rst_stream_counter > rst_stream_threshold) {
// Here, you can choose to close the connection gracefully or drop it
// For demonstration purposes, we'll just print a message
printf("Excessive RST_STREAM frames received. Closing the connection.\n");
// You can call nghttp2_submit_goaway() to send a GOAWAY frame if needed.
// nghttp2_submit_goaway(session, NGHTTP2_FLAG_NONE, error_code, opaque_data);
// Then, close the connection.
}
}
// Continue processing other frames if needed
return 0;
}
int main() {
// Initialize nghttp2_session and set up the on_frame_recv_callback
nghttp2_session* session;
int rst_stream_counter = 0;
// Initialize nghttp2_session, set up callbacks, etc.
// ...
// Set the user data to be passed to the callback
nghttp2_session_user_data(session, &rst_stream_counter);
// Register the on_frame_recv_callback
nghttp2_session_callbacks* callbacks;
nghttp2_session_callbacks_new(&callbacks);
nghttp2_session_callbacks_set_on_frame_recv_callback(callbacks, on_frame_recv_callback);
// Other callback registrations here...
// Attach the callbacks to the session
nghttp2_session_server_new(&session, callbacks, &rst_stream_counter);
// Start processing HTTP/2 frames
// ...
// Cleanup and finish the program
// ...
return 0;
}Development mitigationsFor Golang: The default stream concurrency limit in import (
"fmt"
"golang.org/x/net/http2"
"net/http"
)
func main() {
// Create an HTTP/2 server instance
http2Server := &http2.Server{}
// Set the desired stream concurrency limit
maxConcurrentStreams := 500 // Change this to your desired limit
http2Server.MaxConcurrentStreams = uint32(maxConcurrentStreams)
// Configure an HTTP server to use HTTP/2 with the adjusted settings
server := &http.Server{
Addr: ":8080",
Handler: http.HandlerFunc(handleRequest),
}
http2.ConfigureServer(server, http2Server)
// Start the HTTP server
err := server.ListenAndServeTLS("cert.pem", "key.pem")
if err != nil {
fmt.Println("Error:", err)
}
}Development mitigationsFor netty: import io.netty.handler.codec.http2.Http2FrameListener;
import io.netty.handler.codec.http2.Http2FrameStream;
import io.netty.handler.codec.http2.Http2ResetFrame;
import io.netty.handler.codec.http2.Http2HeadersFrame;
public class CustomHttp2FrameListener implements Http2FrameListener {
private int rstFrameCount = 0;
private int maxRstFrameCount = 10; // Adjust this to your desired limit
private long resetTimeMillis = System.currentTimeMillis();
private long resetTimeIntervalMillis = 60000; // 60 seconds
@Override
public int onDataRead(Http2FrameStream stream, byte[] data, int padding, boolean endOfStream) {
// Handle data frames if needed
return 0;
}
@Override
public void onHeadersRead(Http2FrameStream stream, Http2HeadersFrame headersFrame) {
// Handle headers frames if needed
}
@Override
public void onHeadersRead(Http2FrameStream stream, Http2HeadersFrame headersFrame, boolean endOfStream) {
// Handle headers frames if needed
}
@Override
public void onRstStreamRead(Http2FrameStream stream, Http2ResetFrame resetFrame) {
long currentTimeMillis = System.currentTimeMillis();
// Check if the reset time interval has passed, and reset the count if needed
if (currentTimeMillis - resetTimeMillis >= resetTimeIntervalMillis) {
rstFrameCount = 0;
resetTimeMillis = currentTimeMillis;
}
rstFrameCount++;
// Check if the count exceeds the limit
if (rstFrameCount > maxRstFrameCount) {
// Take action, e.g., close the connection, log, or drop frames
// You can use stream or resetFrame to get more context if needed.
// To close the connection, you can use stream.connection().close();
}
}
}[ CVE-2022-45143 ] org.apache.tomcat.embed:tomcat-embed-core 9.0.63Description: In order to display HTTP errors, such as "404 - Page Not Found" or "403 - Forbidden", Tomcat uses one of the error report valve classes. By default, it uses the When using The fix for the vulnerability added escaping to all fields that are not constant in Example of an error JSON with user input before the fix, injecting a new The same error JSON with user input after the fix: [ CVE-2022-42252 ] org.apache.tomcat.embed:tomcat-embed-core 9.0.63Description: Jakarta EE, formerly known as the Java Platform, is a set of specifications that extends Java SE with specifications for enterprise features such as distributed computing and web services.
In Tomcat's configuration, the attribute When In Apache Tomcat 8, The fix for the vulnerability changes the behavior of [ CVE-2024-38808 ] org.springframework:spring-expression 5.3.20Description: Specifically, an application is vulnerable when the following is true:
[ CVE-2023-51074 ] com.jayway.jsonpath:json-path 2.5.0Description: [ CVE-2023-42795 ] org.apache.tomcat.embed:tomcat-embed-core 9.0.63Description: Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. [ CVE-2023-45648 ] org.apache.tomcat.embed:tomcat-embed-core 9.0.63Description: Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue. [ CVE-2023-41080 ] org.apache.tomcat.embed:tomcat-embed-core 9.0.63Description: The vulnerability is limited to the ROOT (default) web application. [ CVE-2022-24329 ] org.jetbrains.kotlin:kotlin-stdlib 1.5.32Description: [ CVE-2024-24549 ] org.apache.tomcat.embed:tomcat-embed-core 9.0.63Description: The This mechanism allows an attacker to send an Apache Tomcat must enable [ CVE-2024-23672 ] org.apache.tomcat.embed:tomcat-embed-websocket 9.0.63Description: The suspend/resume feature in A flaw in the The flaw is the lack of session timeout, which means that a Websocket Session could be left open for an unlimited amount of time. By creating enough WebSockets that will consume enough resources, attackers may crash the server. Note: To exploit this CVE the server must use the [ CVE-2024-31573 ] org.xmlunit:xmlunit-core 2.8.4Description: Remediation: Development mitigationsUsers running XSLT transformations with untrusted stylesheets should explicitly use XMLUnit's APIs to pass in a pre-configured TraX To set security measures: import org.xmlunit.transform.Transformation;
import javax.xml.transform.Result;
import javax.xml.transform.Source;
import javax.xml.transform.TransformerConfigurationException;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.stream.StreamResult;
import javax.xml.transform.stream.StreamSource;
public class App {
public static void main(String[] args) {
Transformation transformation = new Transformation();
Source xml = new StreamSource("src\\resources\\1.xml");
transformation.setSource(xml);
Source xsl = new StreamSource("src\\resources\\1.xsl");
transformation.setStylesheet(xsl);
// Create a transformer factory and disable extension functions
TransformerFactory transformerFactory = TransformerFactory.newInstance();
transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
// Set the configured transformer factory in the transformation
transformation.setFactory(transformerFactory);
Result result = new StreamResult("output.xml");
transformation.transformTo(result);
}
}[ CVE-2022-1471 ] org.yaml:snakeyaml 1.28Description: It was discovered that a crafted YAML file containing a Java SnakeYaml's Constructor class, which inherits from SafeConstructor, allows any class type to be deserialized. A ConstructorException is thrown, but only after the malicious To exploit this issue, an attacker must find remote input that propagates into the A remote code execution PoC example, using the Java built-in class The PoC will run an arbitrary JAR file supplied from Note that the vulnerability will not apply to applications that use the (non-default) Remediation: Development mitigationsUse the (non-default) Note that this class will only allow deserialization of basic types such as Integers, Strings, Maps etc. [ CVE-2016-1000027 ] org.springframework:spring-web 5.3.20Description: Remediation: Deployment mitigationsDo not use Java serialization for external endpoints (Do not extend the [ CVE-2023-1370 ] net.minidev:json-smart 2.4.8Description: [ CVE-2023-20883 ] org.springframework.boot:spring-boot-autoconfigure 2.5.14Description: Note that the vulnerability only affects applications that meet all of the following requirements:
Remediation: Deployment mitigationsConfigure the reverse proxy not to cache 404 responses and/or not to cache responses to requests to the root (/) of the application. [ CVE-2023-24998 ] org.apache.tomcat.embed:tomcat-embed-core 9.0.63Description: If an HTTP request is submitted using the POST method, and with a content type of It was discovered that It should be noted that upgrading to the fixed version is not sufficient to resolve the issue. [ CVE-2022-42003 ] com.fasterxml.jackson.core:jackson-databind 2.12.6.1Description: ObjectMapper mapper = new ObjectMapper();
mapper.enable(JsonParser.Feature.UNWRAP_SINGLE_VALUE_ARRAYS);
mapper.readTree(untrusted_data); The issue is likely to be exploited in vulnerable configurations since a public exploit exists. Remediation: Development mitigationsIf possible, do not include the [ CVE-2022-42004 ] com.fasterxml.jackson.core:jackson-databind 2.12.6.1Description: ObjectMapper mapper = new ObjectMapper();
mapper.enable(JsonParser.Feature.UNWRAP_SINGLE_VALUE_ARRAYS);
mapper.readTree(untrusted_data); The issue is likely to be exploited in vulnerable configurations since a public exploit exists. Remediation: Development mitigationsIf possible, do not include the [ CVE-2022-25857 ] org.yaml:snakeyaml 1.28Description: It was discovered that a crafted YAML file containing many nested keys can lead to denial of service due to stack exhaustion. A PoC was published here Remediation: Development mitigationsWrap SnakeYAML's try {
String parsed = yaml.load(strYaml);
}
catch(StackOverflowError e) {
System.err.println("ERROR: Stack limit reached");
}[ CVE-2023-20861 ] org.springframework:spring-expression 5.3.20Description: [ CVE-2023-35116 ] com.fasterxml.jackson.core:jackson-databind 2.12.6.1Description: [ CVE-2023-20863 ] org.springframework:spring-expression 5.3.20Description: The most common usage of SpEL is to provide an expression string that is evaluated against a specific object instance (called the root object). SpEL also supports array creation in its query. It was discovered that long SpEL expressions may cause the SpEL engine to consume an exponential amount of resources, which leads to a denial-of-service. To exploit this issue, an attacker must be able to provide a crafted SpEL expression that will be evaluated in the target web application (for example, through the Example of a malicious SpEL query that exploits this issue: [ CVE-2022-41854 ] org.yaml:snakeyaml 1.28Description: When loading a YAML document, SnakeYAML uses recursion to parse objects from the document. It was discovered that a crafted YAML file containing a deeply nested YAML can lead to denial of service due to stack exhaustion. A PoC was published here Despite the vulnerability being fixed and patched on SnakeYAML v1.32 or later, a non-default configuration ( Remediation: Development mitigationsWrap SnakeYAML's try {
String parsed = yaml.load(strYaml);
}
catch(StackOverflowError e) {
System.err.println("ERROR: Stack limit reached");
}[ CVE-2022-38749 ] org.yaml:snakeyaml 1.28Description: It was discovered that a crafted YAML file containing a deeply nested expression can lead to denial of service due to stack exhaustion. A crashing PoC was published here Remediation: Development mitigationsWrap SnakeYAML's try {
String parsed = yaml.load(strYaml);
}
catch(StackOverflowError e) {
System.err.println("ERROR: Stack limit reached");
}[ CVE-2022-38750 ] org.yaml:snakeyaml 1.28Description: When loading a YAML document, SnakeYAML uses recursion to parse objects from the document. It was discovered that a crafted YAML file containing a deeply nested YAML can lead to denial of service due to stack exhaustion. A PoC was published here Remediation: Development mitigationsWrap SnakeYAML's try {
String parsed = yaml.load(strYaml);
}
catch(StackOverflowError e) {
System.err.println("ERROR: Stack limit reached");
}[ CVE-2022-38751 ] org.yaml:snakeyaml 1.28Description: It was discovered that a crafted YAML file containing an extremely long regular expression can lead to denial of service due to stack exhaustion. A PoC was published [here](PoC demonstrates denial of service) Remediation: Development mitigationsWrap SnakeYAML's try {
String parsed = yaml.load(strYaml);
}
catch(StackOverflowError e) {
System.err.println("ERROR: Stack limit reached");
}[ CVE-2022-38752 ] org.yaml:snakeyaml 1.28Description: It was discovered that a crafted YAML file containing a short regular expression can lead to denial of service due to stack exhaustion. A PoC was published here Remediation: Development mitigationsWrap SnakeYAML's try {
String parsed = yaml.load(strYaml);
}
catch(StackOverflowError e) {
System.err.println("ERROR: Stack limit reached");
} |
No description provided.