CVE-2021-28667

StackStorm < 3.4.1, Python 3.x, non-utf-8 locale, Unicode data, infinite loop

• CVSS 7.5
• CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
• Resource Management
• Local

StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Python 3.x is used, the locale is not utf-8, and there is an attempt to log Unicode data (from an action or rule name).

CVE

CVE-2021-28667

CWE

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

CVSS base score

7.5

Published

2021-03-18

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Local

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update StackStorm to version 3.4.1 or higher.

import logging
import locale

# Set locale to a non-UTF-8 locale (for demonstration purposes)
locale.setlocale(locale.LC_ALL, 'en_US.ISO-8859-1')

# Configure logging
logging.basicConfig(level=logging.INFO)

def log_unicode_data(action_name):
    # Attempt to log Unicode data without handling encoding
    logging.info("Action executed: %s", action_name)

# Example usage that may cause an infinite loop or crash
while True:
    log_unicode_data("Example Action with Unicode: ñ")

import logging
import locale

# Ensure the locale is set to UTF-8
try:
    locale.setlocale(locale.LC_ALL, 'en_US.UTF-8')
except locale.Error:
    # Fallback to a safe locale if UTF-8 is not available
    locale.setlocale(locale.LC_ALL, 'C.UTF-8')

# Configure logging
logging.basicConfig(level=logging.INFO)

def log_unicode_data(action_name):
    # Safely encode the action name to avoid issues with non-UTF-8 locales
    try:
        logging.info("Action executed: %s", action_name)
    except UnicodeEncodeError:
        logging.error("Failed to log action name due to encoding issues.")

# Example usage
log_unicode_data("Example Action with Unicode: ñ")

@misc{vaitp:cve202128667,
  title        = {{StackStorm < 3.4.1, Python 3.x, non-utf-8 locale, Unicode data, infinite loop}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2021},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-28667},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-28667/}}
}