Executive Summary

This vulnerability exists in Kanidm, an identity management platform, prior to version 1.9.3. An unauthenticated attacker can send a single GET request to any /scim/v1/... endpoint with a specially crafted ?filter= query string containing a few thousand nested parentheses (approximately 4–12 KB). This causes the recursive-descent PEG parser to exceed the worker thread's stack guard page, leading to a stack overflow.

When the stack overflow occurs, Rust's standard library responds by aborting the entire kanidmd process. The parsing happens before any access control checks, meaning the attack can be performed without authentication.

This issue has been fixed in Kanidm version 1.9.3.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a denial of service (DoS) by crashing the kanidmd process whenever a maliciously crafted request is received. Since the process aborts on stack overflow, the service becomes unavailable until it is restarted.

Because the attack requires no authentication and occurs before any access control checks, an attacker can easily disrupt the identity management service, potentially impacting availability and reliability.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been patched in Kanidm version 1.9.3. Immediate mitigation involves upgrading Kanidm to version 1.9.3 or later.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes the kanidmd process to abort when processing a specially crafted unauthenticated request, resulting in a denial of service.

Since the denial of service occurs before any access control checks, it could potentially disrupt availability of the identity management service.

However, there is no information provided about any data breach, unauthorized data access, or data loss related to this vulnerability.

Therefore, while this issue may impact service availability, there is no direct indication that it affects compliance with data protection regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unexpected crashes or restarts of the kanidmd process, as the vulnerability causes the process to abort upon receiving a specially crafted GET request.

Specifically, an unauthenticated GET request to any /scim/v1/... endpoint with a ?filter= query string containing a few thousand nested parentheses (approximately 4–12 KB in size) triggers the issue.

To detect attempts to exploit this vulnerability, you can use network monitoring tools or web server logs to identify such suspicious GET requests.

• Use tools like tcpdump or Wireshark to capture HTTP GET requests to /scim/v1/ endpoints with large filter query parameters.
• Example tcpdump command to capture HTTP GET requests to /scim/v1/:
• tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'GET /scim/v1/'
• Check kanidmd process logs or system logs for unexpected process aborts or crashes.
• Use monitoring tools to alert on kanidmd process restarts.

Useful 0 Not Useful 0