Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1tajM1LTJyZ2YtY3Y4cM4AA6l2

OpenID Connect client Atom Exhaustion in provider configuration worker ets table location

Impact

DOS by Atom exhaustion is possible by calling oidcc_provider_configuration_worker:get_provider_configuration/1 or oidcc_provider_configuration_worker:get_jwks/1.

Since the name is usually provided as a static value in the application using oidcc, this is unlikely to be exploited.

Details

Example to illustrate the vulnerability.

{ok, Claims} =
  oidcc:retrieve_userinfo(
    Token,
    myapp_oidcc_config_provider,
    <<"client_id">>,
    <<"client_secret">>,
    #{}
  )

The vulnerability is present in oidcc_provider_configuration_worker:get_ets_table_name/1.
The function get_ets_table_name is calling erlang:list_to_atom/1.

https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388

There might be a case (Very highly improbable) where the 2nd argument of
oidcc_provider_configuration_worker:get_*/1 is called with a different atom each time which eventually leads to
the atom table filling up and the node crashing.

Patches

Patched in 3.0.2, 3.1.2 & 3.2.0-beta.3

Workarounds

Make sure only valid provider configuration worker names are passed to the functions.

References

Permalink: https://github.com/advisories/GHSA-mj35-2rgf-cv8p
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tajM1LTJyZ2YtY3Y4cM4AA6l2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 months ago
Updated: about 2 months ago


CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

Identifiers: GHSA-mj35-2rgf-cv8p, CVE-2024-31209
References: Repository: https://github.com/erlef/oidcc
Blast Radius: 1.6

Affected Packages

hex:oidcc
Dependent packages: 3
Dependent repositories: 2
Downloads: 104,558 total
Affected Version Ranges: >= 3.2.0-beta.1, < 3.2.0-beta.3, >= 3.1.0, < 3.1.2, >= 3.0.0, < 3.0.2
Fixed in: 3.2.0-beta.3, 3.1.2, 3.0.2
All affected versions: 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0-beta.1, 3.2.0-beta.2
All unaffected versions: 1.0.0, 1.0.1, 1.1.0, 1.2.0, 1.2.1, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.6.0, 1.7.0, 1.8.0, 1.8.1, 3.0.2, 3.1.2, 3.2.0