Remote Code Execution in Elixir-GRPC

Compliance Impact

The vulnerability allows unauthenticated attackers to achieve remote code execution and denial-of-service attacks on the server, leading to high impact on confidentiality, integrity, and availability of the affected system.

Such impacts can compromise compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and system availability.

Specifically, unauthorized remote code execution and system crashes could lead to unauthorized access or loss of protected data, violating data protection and security requirements.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual or malformed gRPC requests with the Content-Type header set to application/grpc+erlpack, which may indicate attempts to exploit the unsafe deserialization.

On the system side, detection involves checking for symptoms such as crashes of the BEAM node or exhaustion of the atom table, which may be caused by crafted payloads minting arbitrary atoms.

Specific commands to detect exploitation attempts are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the elixir-grpc/grpc library to version 1.0.0 or later, where the vulnerability has been fixed.

The fix includes using the :safe option with :erlang.binary_to_term/2 to prevent atom table exhaustion and blocking dangerous terms like functions, PIDs, ports, and references to avoid remote code execution.

Users should also ensure that the GRPC.Codec.Erlpack codec is properly updated and registered according to the patched version.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the elixir-grpc grpc library versions from 0.4.0 before 1.0.0. It involves unsafe deserialization of untrusted data and allocation of resources without limits or throttling.

Specifically, the function 'Elixir.GRPC.Codec.Erlpack':decode/2 calls :erlang.binary_to_term/1 on the raw gRPC message body without using the :safe option, without size limits, and without type checks.

An unauthenticated attacker can send a crafted gRPC request with Content-Type: application/grpc+erlpack that creates arbitrary new atoms, which are never garbage-collected, leading to exhaustion of the atom table and crashing the BEAM virtual machine.

Additionally, if the crafted payload encodes a 'fun' term that is invoked downstream, it can lead to remote code execution on the server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including denial of service and remote code execution.

• Denial of Service: An attacker can exhaust the atom table by creating arbitrary atoms, causing the BEAM virtual machine to crash and making the service unavailable.
• Remote Code Execution: If the crafted payload includes a 'fun' term that is executed downstream, the attacker can run arbitrary code on the server, potentially compromising the system.

Because the attack can be performed by an unauthenticated peer, it poses a high risk to systems using affected versions of elixir-grpc.

Useful 0 Not Useful 0