envoyproxy / envoyproxy/envoy

Excessive recursion in MongoDB extension may lead to crash

Open
#19,979 2 comments 0 reactions 0 assignees View on GitHub
area/mongodb bug help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
428

Description

*Title*: *Excessive recursion in MongoDB extension may lead to crash*

*Description*:
Clarification - This is reported here and not to the "envoy-security" mailing group, per the request of that mailing group, since the MongoDB extension is outside of the security threat scope.

The DecoderImpl::fromBuffer function in [bson_impl.cc](https://github.com/envoyproxy/envoy/blob/027d6ca15adeae8cd478fcce67fc24322318e52e/source/extensions/filters/network/mongo_proxy/bson_impl.cc#L370) parses BSON buffers into structures representing them. The code [reads the byte](https://github.com/envoyproxy/envoy/blob/027d6ca15adeae8cd478fcce67fc24322318e52e/source/extensions/filters/network/mongo_proxy/bson_impl.cc#L392) that represents the type of the next element of the message and then creates the structure that represents this type and adds it to its parent element. Some of the elements are decoded by the same DecoderImpl::fromBuffer itself, such as the Document element, causing a [recursion](https://github.com/envoyproxy/envoy/blob/027d6ca15adeae8cd478fcce67fc24322318e52e/source/extensions/filters/network/mongo_proxy/bson_impl.cc#L419). Since there is no code that checks the recursion depth, it is possible to make the code recurse again and again (even when parsing a relatively small packet) until the stack is exhausted and the process crashes.

*Repro steps*:
1. Configure envoy with the configuration specified in the *Config* section
2. Run the following Python script -
(Script assumes Envoy on 192.168.188.133:10000, Script may need to be executed several times before causing a crash)
```python
from socket import *
import struct

s = socket(AF_INET, SOCK_STREAM)
s.connect(("192.168.188.133", 10000)) # Change to Envoy IP address

inner_data = '\x03a\x00'
my_data = '\x07\x00\x00\x00\x03a\x00'

for i in range(6000):
my_data = struct.pack("

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.