Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
esaml の SAML 応答処理で、細工した圧縮データを送られると大量のメモリを消費し、Erlang VM がクラッシュする問題です。認証なしで攻撃でき、影響を受けるのは 0.1.0 以降の全版です。修正版は公開されていないため、最新の情報を確認してください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| Hex | esaml |
≥ 0.1.0 (pas de correctif) |
— |
| handnot2 | esaml |
≥ deeb84378d5c82153b470e99d24f77c38afca14a (pas de correctif) |
— |
| arekinath | esaml |
≥ deeb84378d5c82153b470e99d24f77c38afca14a (pas de correctif) |
— |
| dropbox | esaml |
≥ deeb84378d5c82153b470e99d24f77c38afca14a (pas de correctif) |
— |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the Erlang VM via a crafted compressed SAMLResponse.
esaml_binding:decode_response/2 base64-decodes the attacker-supplied SAMLResponse, inflates it with zlib:unzip/1 with no bound on the output, then converts the result to a charlist with binary_to_list/1 before parsing. This runs on the SAML consume (ACS) and single-logout endpoints, which accept unauthenticated requests by design, and it runs before any signature check. A small deflate stream reaches a compression ratio near 1000 to 1, so a request body of tens of kilobytes inflates to hundreds of megabytes and then to several gigabytes of list heap, so a few requests exhaust memory and take the node down.
This issue affects esaml: from 0.1.0 onward.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- package hex.pm
- web cna.erlef.org
- web github.com
- web github.com
- web github.com
- web osv.dev
- web nvd.nist.gov
- web github.com