PT-2022-20463 · Vapor · Vapor

0Xtim · Published 2022-06-06 · Updated 2023-06-29 · CVE-2022-31019

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Vapor versions prior to 4.61.1

Description The issue is related to unbounded, attacker-controlled stack growth, which can lead to a stack overflow and a process crash when using automatic content decoding. An attacker can craft a request body to make the server crash. The estimated number of potentially affected devices is not specified.

Recommendations For Vapor versions prior to 4.61.1, update to version 4.61.1 to resolve the issue. As a temporary workaround, consider disabling the ContentConfiguration to prevent the use of Form URL Encoded data decoding. Alternatively, restrict the use of the URLEncodedFormDecoder to minimize the risk of exploitation.

Exploit

Fix

Uncontrolled Recursion

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-674

CWE-121

CWE-120

Related Identifiers

CVE-2022-31019

GHSA-QVXG-WJXC-R4GG

Affected Products

Vapor

References · 8

• 🔥 https://github.com/vapor/vapor/commit/6c63226a4ab82ce53730eb1afb9ca63866fcf033 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31019.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-31019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31019 · Security Note
• https://osv.dev/vulnerability/GHSA-qvxg-wjxc-r4gg · Vendor Advisory
• https://github.com/vapor/vapor · Note
• https://github.com/vapor/vapor/security/advisories/GHSA-qvxg-wjxc-r4gg · Note
• https://t.me/cibsecurity/44086 · Telegram Post