GHSA-pwq4-h95h-5634: High severity Eclipse Kura vulnerability
In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid credentials can therefore send a few dozen large JSON requests at the same time, exhaust the Java heap with an OutOfMemoryError, and cause a denial of service. Likewise, a remote attacker, can send a deeply nested JSON request and trigger a StackOverflowError because of an unbound recursion in Service Listing V1.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker able to reach the Service Listing V1 REST API can exploit it without valid credentials. Authentication is checked only after the request body has been read and parsed.
Are affected systems vulnerable with the default API behavior?
The issue is in the Service Listing V1 REST API request handling in Eclipse Kura 5.4.0 through 5.6.2. The provided information does not identify a configuration change or feature setting required for exploitation beyond the API being reachable.
What attack traffic should defenders look for?
Look for concurrent requests carrying unusually large JSON bodies to Service Listing V1 endpoints, which can exhaust the Java heap and produce OutOfMemoryError conditions. Also look for deeply nested JSON request bodies that may trigger StackOverflowError.
What happens when exploitation succeeds?
Large concurrent JSON requests can exhaust the Java heap and deny service. A deeply nested JSON payload can also cause a StackOverflowError through unbounded recursion in the API's JSON processing.