CVE-2023-4785

gRPC TCP server v1.23+ on POSIX: No error handling, DoS via excessive connections

• CVSS 7.5
• CWE-248 Uncaught Exception
• Resource Management
• Remote

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected.

CVE

CVE-2023-4785

CWE

CWE-248 Uncaught Exception

CVSS base score

7.5

Published

2023-09-13

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update gRPC to version 1.23.1 or higher.

import grpc
from concurrent import futures
import time

class MyServiceServicer:
    def MyMethod(self, request, context):
        return "Response"

def serve():
    server = grpc.server(futures.ThreadPoolExecutor(max_workers=10))
    
    server.add_insecure_port('[::]:50051')
    server.start()
    print("Server started, listening on port 50051.")
    
    while True:
        time.sleep(86400)

if __name__ == '__main__':
    serve()

import grpc
from concurrent import futures
import time
from grpc import ssl_channel_credentials

class MyServiceServicer:
    def MyMethod(self, request, context):
        return "Response"

def serve():
    server = grpc.server(futures.ThreadPoolExecutor(max_workers=10))
    
    with open('server.crt', 'rb') as f:
        server_cert = f.read()
    with open('server.key', 'rb') as f:
        server_key = f.read()

    server_credentials = ssl_channel_credentials(certificates=(server_cert, server_key))

    server.add_secure_port('[::]:50051', server_credentials)
    server.start()
    print("Secure server started, listening on port 50051.")

    while True:
        time.sleep(86400)

if __name__ == '__main__':
    serve()

@misc{vaitp:cve20234785,
  title        = {{gRPC TCP server v1.23+ on POSIX: No error handling, DoS via excessive connections}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-4785},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-4785/}}
}