Lucene search

K
gitlabHttps://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-2EC0BF49CAFF788B96B1050B5671A733
HistoryJun 09, 2023 - 12:00 a.m.

Vapor's Metrics integration could cause a system drain

2023-06-0900:00:00
https://gitlab.com/gitlab-org/security-products/gemnasium-db
gitlab.com
2
vapor
metrics integration
system drain
dos attack
attack vector
unlimited requests
downstream services
error paths two.

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

6.8

Confidence

Low

This is a DoS attack against anyone who Bootstraps a metrics backend for their Vapor app with the following attack vector:

  1. send unlimited requests against a vapor instance with different paths. this will create “unlimited” counters and timers, which will eventually drain the system.
  2. downstream services might suffer from this attack as well by being spammed with error paths

Affected configurations

Vulners
Node
swiftvaporRange<4.40.1
VendorProductVersionCPE
swiftvapor*cpe:2.3:a:swift:vapor:*:*:*:*:*:*:*:*

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

6.8

Confidence

Low

Related for GITLAB-2EC0BF49CAFF788B96B1050B5671A733