Internet Bug Bounty · Report #1954937
Possible DoS Vulnerability in Multipart MIME parsing in rack
Summary
[CVE-2023-27530] Possible DoS Vulnerability in Multipart MIME parsing Security Announcements
There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.
Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3
Impact The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases The fixed releases are available at the normal locations.
Workarounds A proxy can be configured to limit the POST body size which will mitigate this issue.
Patches To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
3-0-multipart-dos.patch - Patch for the 3.0 series 2-2-multipart-dos.patch - Patch for the 2.2 series 2-1-multipart-dos.patch - Patch for the 2.1 series 2-0-multipart-dos.patch - Patch for the 2.0 series
Credits Thanks to @das7pad for reporting this!
Full Security Advisory: https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388
How it was found
In Rack 3.0.4.x before 3.0.4.2, 2.2.6.x before 2.2.6.3, 2.1.4 before 2.1.4.3 and 2.0.9.x before 2.0.9.3, the multipart request parser was subject to a Denial of Service attack. The multipart request parser processes the request body on any POST endpoints. The parser was processing an unlimited number of empty/field multipart-parts.The parsing and tracking of an unbound number of parts can lead to extensive CPU usage and memory exhaustion. The vulnerability affects all rails applications, unless they are behind a proxy that blocks POST requests with large bodies (double digit MB).
Side note: The DoS vectors are not unique to the multipart request parser in Rack. Many other large vendors (other programming languages/frameworks/applications) were notified about the DoS vectors as well and an embargo date was set for the coordinated disclosure.
The Rack maintainers took part in a coordinated disclosure of the DoS vulnerability with many other large vendors. This required scheduling a dedicated release for the fixes in Rack. Unfortunately, the maintainers missed the embargo date due to issues with getting a hold of a CVE for the vulnerability.
The issue was reported via HackerOne, the report is https://hackerone.com/reports/1789204.
Impact
High CPU usage blocks workers and significantly delays other requests from getting processed (minutes). High memory usage can lead to the application getting OOM killed.