GHSA-mwr4-5g34-j5cq: Erlang/grpc vulnerability
Summary
In the HTTP-to-gRPC transcoding layer of the grpc Hex package, query-string and request-body parameters can silently overwrite path-bound fields when building the decoded protobuf request struct. An authenticated attacker who can reach a transcoded endpoint can substitute any path-bound identifier (e.g. userid from /users/{userid}/profile) with an arbitrary value, bypassing authorization, multi-tenancy, and ownership checks that rely on the path-derived field.
Details
All three clauses of GRPC.Server.Transcode.maprequest/5 (grpcserver/lib/grpc/server/transcode.ex) use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. Path bindings are extracted by the router from the matched URL template and should be the authoritative resource identifiers, but query-string and body parameters overwrite them. The decoded protobuf struct handed to the handler carries the attacker's value instead of the router's.
PoC
1. Deploy a transcoded gRPC service with a route like GET /users/{userid}/profile where the handler authorizes access based on request.userid. 2. Send: GET /users/me/profile?userid=victim 3. The decoded request struct has userid = "victim" — the authorization check passes for the victim's resource, not the caller's. 4. Alternatively, for a POST with body: "": send {"userid": "victim"} in the JSON body.
Impact
Affects applications using grpc ≥ 0.8.0 with HTTP transcoding enabled that rely on path-bound fields for authorization or tenant isolation. Fixed in 1.0.0. An authenticated attacker can read or modify any other user's resources exposed via transcoded endpoints.
References
Introduction commit: https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048 Patch commit: https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
erlang/grpcto a version that resolves this vulnerability.Fixed in 1.0.0 - Upgrade
Upgrade
elixir-grpc/grpc (Hex package)to a version that resolves this vulnerability.Fixed in 1.0.0 - Compensating control
If upgrading is not immediately possible, avoid HTTP transcoding route designs that authorize/multi-tenant based on path-bound fields (e.g., handlers that rely on `request.user_id` from routes like `GET /users/{user_id}/profile`), because transcoding can allow query-string/body parameters (e.g., `GET /users/me/profile?user_id=victim`) to overwrite path-bound values.
Event History
Frequently Asked Questions
Which services are exposed to a meaningful authorization bypass?
Transcoded gRPC endpoints with path-bound identifiers are exposed when their handlers make authorization, tenancy, or ownership decisions using the corresponding field in the decoded protobuf request. For example, a handler that trusts request.user_id for a route containing /users/{user_id} can be affected.
What access does an attacker need to exploit this?
The attacker must be authenticated and able to reach a vulnerable HTTP-to-gRPC transcoded endpoint. They can supply the same path-bound field in the query string or request body with a chosen value.
Does matching the intended URL path prevent the identifier from being changed?
No. The router extracts the path binding from the matched URL template, but the decoded protobuf request passed to the handler can contain an overriding query-string or body value instead.