esaml に圧縮データの過剰展開によるメモリ枯渇の脆弱性 認証不要で攻撃可能
Summary
esaml の SAML 応答処理で、細工した圧縮データを送られると大量のメモリを消費し、Erlang VM がクラッシュする問題です。認証なしで攻撃でき、影響を受けるのは 0.1.0 以降の全版です。修正版は公開されていないため、最新の情報を確認してください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
esaml の SAML 応答処理で、細工した圧縮データを送られると大量のメモリを消費し、Erlang VM がクラッシュする問題です。認証なしで攻撃でき、影響を受けるのは 0.1.0 以降の全版です。修正版は公開されていないため、最新の情報を確認してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Hex | esaml |
≥ 0.1.0 (no fix yet) |
— |
| handnot2 | esaml |
≥ deeb84378d5c82153b470e99d24f77c38afca14a (no fix yet) |
— |
| arekinath | esaml |
≥ deeb84378d5c82153b470e99d24f77c38afca14a (no fix yet) |
— |
| dropbox | esaml |
≥ deeb84378d5c82153b470e99d24f77c38afca14a (no fix yet) |
— |
Original description The description as published by the source.
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.
esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.
This issue affects esaml: from 0.1.0 onward.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- package hex.pm
- web cna.erlef.org
- web github.com
- web github.com
- web github.com
- web osv.dev
- web nvd.nist.gov
- web github.com