Hash Collision DoS in MessagePack for C#

Executive Summary

This vulnerability exists in MessagePack for C#, specifically in versions prior to 2.5.301 and 3.1.7. The issue is that the InterfaceLookupFormatter<Tkey,TElement> constructs an internal dictionary using the default equality comparer instead of a security-aware comparer provided by the application's security options. This omission allows an attacker to exploit hash collisions, leading to a CPU denial of service attack against ILookup<TKey,TElement> even if the application has enabled untrusted-data security measures.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can be exploited to cause a denial of service by forcing excessive CPU usage through hash collisions. This means that an attacker can degrade or disrupt the availability of applications using the affected versions of MessagePack for C#, potentially causing performance issues or outages.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update MessagePack for C# to version 2.5.301 or 3.1.7 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is related to the MessagePack-CSharp library versions prior to 2.5.301 and 3.1.7, specifically in the InterfaceLookupFormatter which uses a default equality comparer instead of a security-aware comparer. Detection involves identifying if your system or application is using an affected version of the MessagePack-CSharp library.

Since this is a software library vulnerability, detection on a network level is not straightforward. Instead, you should check the version of the MessagePack-CSharp library used in your application dependencies.

Suggested commands to detect the vulnerable versions in your project environment include:

• For .NET projects using NuGet, run: `dotnet list package | findstr MessagePack` or `nuget list MessagePack` to check the installed version.
• For projects using package.config, inspect the package.config file or run: `nuget.exe list MessagePack -AllVersions` and compare with installed versions.
• Check your project files (e.g., .csproj) for the MessagePack package version.

If you observe versions earlier than 2.5.301 or 3.1.7, your system is vulnerable and should be updated.

Additionally, monitoring for unusual CPU usage or performance degradation in services using MessagePack deserialization of untrusted data might indicate exploitation attempts, but no specific network detection commands are provided.

Useful 0 Not Useful 0