CVE-2019-3558
Python Facebook Thrift servers < v2019.02.18.00: Parsing DoS via unknown type containers
- CVSS 7.5
- CWE-755 Improper Handling of Exceptional Conditions
- Input Validation and Sanitization
- Remote
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
- CVSS base score
- 7.5
- Published
- 2019-05-06
- OWASP
- A08 Software and Data Integrity Failures
- Orthogonal defect classification
- Timing/Serialization
- Code defect classification
- Timing Issues
- Category
- Input Validation and Sanitization
- Subcategory
- Insecure Parsing or Deserialization
- Accessibility scope
- Remote
- Impact
- Denial of Service (DoS)
- Fixed by upgrading
- Yes
Solution
Update Facebook Thrift to version v2019.02.18.00 or higher.
Vulnerable code sample
from thrift.transport import TTransport
from thrift.protocol import TBinaryProtocol
from thrift.server import TServer
class ThriftHandler:
def process_message(self, message):
depth = 0
while True:
depth += 1
if depth > 10000:
break
return "Message processed successfully"
handler = ThriftHandler()
processor = TProcessor(handler)
transport = TSocket.TServerSocket(host='127.0.0.1', port=9090)
tfactory = TTransport.TBufferedTransportFactory()
pfactory = TBinaryProtocol.TBinaryProtocolFactory()
server = TServer.TSimpleServer(processor, transport, tfactory, pfactory)Patched code sample
from thrift.transport import TTransport
from thrift.protocol import TBinaryProtocol
from thrift.server import TServer
from thrift.transport import TSocket
class ThriftHandler:
def process_message(self, message):
max_depth = 1000
if not message or len(message) > 1000:
raise ValueError("Invalid message size")
depth = 0
while True:
depth += 1
if depth > max_depth:
raise Exception("Exceeded maximum processing depth")
if depth == max_depth:
break
return "Message processed successfully"
handler = ThriftHandler()
processor = TProcessor(handler)
transport = TSocket.TServerSocket(host='127.0.0.1', port=9090)
tfactory = TTransport.TBufferedTransportFactory()
pfactory = TBinaryProtocol.TBinaryProtocolFactory()
server = TServer.TSimpleServer(processor, transport, tfactory, pfactory)
def start_server():
try:
print("Starting the server...")
server.serve()
except Exception as e:
print(f"Error occurred: {e}")
if __name__ == "__main__":
start_server()Cite this entry
@misc{vaitp:cve20193558,
title = {{Python Facebook Thrift servers < v2019.02.18.00: Parsing DoS via unknown type containers}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2019},
note = {VAITP Python Vulnerability Dataset, entry CVE-2019-3558},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-3558/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::