PT-2023-30747 · Unknown+1 · Kj Http Library+2
Published
2023-11-21
·
Updated
2024-01-05
·
CVE-2023-48230
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Cap'n Proto versions 1.0 through 1.0.1
Description
The issue is related to a buffer underrun that can be caused by a remote peer when using the KJ HTTP library with WebSocket compression enabled. This can result in a crash, enabling a remote denial-of-service attack. Most users are unlikely to have this functionality enabled and are therefore unlikely to be affected. The bytes written out-of-bounds are always a specific constant 4-byte string
{ 0x00, 0x00, 0xFF, 0xFF }. Because this string is not controlled by the attacker, it is believed that remote code execution is unlikely, but it cannot be ruled out.Recommendations
For Cap'n Proto versions 1.0 through 1.0.1, update to version 1.0.1.1 to fix the issue.
As a temporary workaround, consider disabling WebSocket compression in the KJ HTTP library via
HttpClientSettings or HttpServerSettings until a patch is available.
Restrict access to the KJ HTTP library to minimize the risk of exploitation.Exploit
Fix
DoS
RCE
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Cap'N Proto
Kj Http Library