dotnet / dotnet/aspnetcore

JQueryKeyValuePairNormalizer is not robust and writes binary derived unicode data into your console

Open
#9,961 4 comments 1 reaction 1 assignee Assigned to @halter73 View on GitHub
affected-medium area-mvc bug feature-model-binding investigate severity-minor
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

With a specifically crafted binary upload, which in my case I happened to stumble upon and `Content-Type: application/x-www-form-urlencoded` set in a request, to any endpoint will trigger a 500 and some very ugly console output.

This line will write up to the maximum allowed form key length into the console via the unhandled exception logger. https://github.com/aspnet/AspNetCore/blob/c565386a3ed135560bc2e9017aa54a950b4e35dd/src/Mvc/Mvc.Core/src/ModelBinding/JQueryKeyValuePairNormalizer.cs#L72

Whatever is in there it'll get output, so any ANSI escape sequences are fair game.

Now this all isn't very exploitable as even stdout for twelve-factor apps would just show these sequences as plain text, but it sure is nasty during development.

Removing this ValueProviderFactory allows the request to reach the controller action where we can then return a neat error in the 400 range for whatever our action actually expects.

In essense:
- This ValueProviderFactory is loaded by default in Mvc.
- It's a parser that's easily tripped by fuzzable inputs.
- When tripped its exception message is not neatly trimmed or otherwise processed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.