Executive Summary

This vulnerability in OpenBao versions prior to 2.4.1 involves the handling of JSON objects. Specifically, after decoding, JSON objects can consume significantly more memory than their serialized form, with a factor of up to approximately 35. An attacker can craft a JSON payload to exploit this, similar to a zip bomb, to bypass the max_request_size limit designed to prevent denial of service attacks. Because the request body is parsed into a map early in the request handling process before authentication, an unauthenticated attacker can send such a payload and cause the system to crash due to out-of-memory conditions. Additionally, requests with many strings can cause the audit subsystem to use excessive CPU resources. The issue is fixed in version 2.4.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial of service (DoS) by causing the OpenBao system to crash due to out-of-memory conditions triggered by specially crafted JSON payloads. It can also cause high CPU usage in the audit subsystem when processing requests with many strings. Since the attack can be performed by unauthenticated users, it poses a significant risk of service disruption.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenBao to version 2.4.1 or later, where this vulnerability is fixed. Until then, consider restricting or filtering unauthenticated requests that contain large or suspicious JSON payloads to prevent out-of-memory crashes.

Useful 0 Not Useful 0