High, CVSS 7.5GoPublished
Potential memory exhaustion attack due to sparse slice deserialization
CVE-2024-37298 · GHSA-3669-72x9-r9p3
- Affected
- Go github.com/gorilla/schema < 1.4.1
- Fixed in
- 1.4.1· Vendor fix available
- Issue
- Details Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. For instance, in the Proof of Concept written below, someone can specify to set a field of the billionth element and it will allocate all other elements before it in the slice. In the local environment environment for my project, I was able to call an endpoint like /innocentendpoint?arr.10000000.X=1 and freeze my system from the memory allocation while parsing r.Form. I think this line is responsible for allocating the slice, although I haven't tested to make sure, so it's just an educated guess. Proof of Concept The following proof of concept works on both v1.2.0 and v1.2.1. I have not tested earlier versions. Impact Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. There seems to be no possible…
Recommended action: Upgrade to 1.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.