PT-2024-33272 · Unknown · Messagepack-Csharp

Aarnott · Published 2024-10-17 · Updated 2024-10-18 · CVE-2024-48924

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MessagePack-CSharp versions prior to 2.5.187 and 3.0.214

Description The vulnerability occurs when the library is used to deserialize messagepack data from an untrusted source, leading to a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions. This results in large CPU consumption disproportionate to the size of the data being deserialized. The issue is similar to a prior advisory, which provided an inadequate fix for the hash collision part of the vulnerability.

Recommendations To mitigate this risk, upgrade to a version of the library where a fix is available. If upgrading from v1, check out the migration guide. Review the steps in the previous advisory to ensure the application is configured for untrusted data. If upgrading MessagePack to a patched version is not an option, apply a manual workaround by declaring a class that derives from MessagePackSecurity, overriding the GetHashCollisionResistantEqualityComparer method to provide a collision-resistant hash function, and configuring MessagePackSerializerOptions with an instance of the derived type. Use the custom options object for all deserialization operations.

Exploit

Fix

Weakness Enumeration

CWE-328

Related Identifiers

CVE-2024-48924

GHSA-4QM4-8HG2-G2XM

Affected Products

Messagepack-Csharp

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48924.json · Exploit
• https://osv.dev/vulnerability/GHSA-4qm4-8hg2-g2xm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48924 · Security Note
• https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-4qm4-8hg2-g2xm · Note
• https://github.com/MessagePack-CSharp/MessagePack-CSharp · Note
• https://github.com/MessagePack-CSharp/MessagePack-CSharp/commit/f8d40b3ad0be01c6e56cb51ecea81f59d98c192d · Note
• https://github.com/MessagePack-CSharp/MessagePack-CSharp/commit/8e599af0798b45008f8b293a7f233e4878f11ed5 · Note
• https://twitter.com/CVEnew/status/1847017617174745519 · Twitter Post
• https://twitter.com/oktsec/status/1847165136827564286 · Twitter Post
• https://twitter.com/CveFindCom/status/1847020243215860080 · Twitter Post
• https://t.me/cvedetector/8256 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1847131172494598266 · Twitter Post