Executive Summary

This vulnerability exists in the elixir-grpc grpc library versions from 0.4.0 before 1.0.0. It involves unsafe deserialization of untrusted data and allocation of resources without limits or throttling.

Specifically, the function 'Elixir.GRPC.Codec.Erlpack':decode/2 calls :erlang.binary_to_term/1 on the raw gRPC message body without using the :safe option, without size limits, and without type checks.

An unauthenticated attacker can send a crafted gRPC request with Content-Type: application/grpc+erlpack that creates arbitrary new atoms, which are never garbage-collected, leading to exhaustion of the atom table and crashing the BEAM virtual machine.

Additionally, if the crafted payload encodes a 'fun' term that is invoked downstream, it can lead to remote code execution on the server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including denial of service and remote code execution.

• Denial of Service: An attacker can exhaust the atom table by creating arbitrary atoms, causing the BEAM virtual machine to crash and making the service unavailable.
• Remote Code Execution: If the crafted payload includes a 'fun' term that is executed downstream, the attacker can run arbitrary code on the server, potentially compromising the system.

Because the attack can be performed by an unauthenticated peer, it poses a high risk to systems using affected versions of elixir-grpc.

Useful 0 Not Useful 0