Impact
DOS by Atom exhaustion is possible by calling oidcc_provider_configuration_worker:get_provider_configuration/1 or oidcc_provider_configuration_worker:get_jwks/1.
Since the name is usually provided as a static value in the application using oidcc, this is unlikely to be exploited.
Details
Example to illustrate the vulnerability.
{ok, Claims} =
oidcc:retrieve_userinfo(
Token,
myapp_oidcc_config_provider,
<<"client_id">>,
<<"client_secret">>,
#{}
)The vulnerability is present in oidcc_provider_configuration_worker:get_ets_table_name/1.
The function get_ets_table_name is calling erlang:list_to_atom/1.
|
get_ets_table_name(WorkerName) when is_atom(WorkerName) -> |
|
{ok, erlang:list_to_atom(erlang:atom_to_list(WorkerName) ++ "_table")}; |
|
get_ets_table_name(_Ref) -> |
|
error. |
There might be a case (Very highly improbable) where the 2nd argument of
oidcc_provider_configuration_worker:get_*/1 is called with a different atom each time which eventually leads to
the atom table filling up and the node crashing.
Patches
Patched in 3.0.2, 3.1.2 & 3.2.0-beta.3
Workarounds
Make sure only valid provider configuration worker names are passed to the functions.
References
mohamedalikhechine Finder
robertfiko Finder
maennchen Remediation developer
paulswartz Remediation reviewer
SAFE-Erlang-Elixir Finder
Impact
DOS by Atom exhaustion is possible by calling
oidcc_provider_configuration_worker:get_provider_configuration/1oroidcc_provider_configuration_worker:get_jwks/1.Since the name is usually provided as a static value in the application using
oidcc, this is unlikely to be exploited.Details
Example to illustrate the vulnerability.
{ok, Claims} = oidcc:retrieve_userinfo( Token, myapp_oidcc_config_provider, <<"client_id">>, <<"client_secret">>, #{} )The vulnerability is present in
oidcc_provider_configuration_worker:get_ets_table_name/1.The function
get_ets_table_nameis callingerlang:list_to_atom/1.oidcc/src/oidcc_provider_configuration_worker.erl
Lines 385 to 388 in 018dbb5
There might be a case (Very highly improbable) where the 2nd argument of
oidcc_provider_configuration_worker:get_*/1is called with a different atom each time which eventually leads tothe atom table filling up and the node crashing.
Patches
Patched in
3.0.2,3.1.2&3.2.0-beta.3Workarounds
Make sure only valid provider configuration worker names are passed to the functions.
References