Executive Summary

This vulnerability occurs when a specifically crafted non-UTF-8 string is sent as the select-asn query parameter to the /api/v1/origins endpoint in Routinator.

As a result, Routinator crashes.

It only affects users who allow API access from untrusted networks.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that Routinator crashes when it receives a maliciously crafted non-UTF-8 string in the select-asn query parameter.

This crash can cause denial of service for users relying on Routinator's API, especially if the API is accessible from untrusted networks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when a specifically crafted non-UTF-8 string is sent as the select-asn query parameter to the /api/v1/origins endpoint, causing Routinator to crash.

To detect this vulnerability on your network or system, you can monitor API requests to the /api/v1/origins endpoint for unusual or malformed select-asn query parameters that contain non-UTF-8 encoded strings.

A possible approach is to capture and inspect HTTP requests to the Routinator API using tools like tcpdump or Wireshark, filtering for requests to /api/v1/origins and analyzing the select-asn parameter for encoding anomalies.

• Use tcpdump to capture traffic on the relevant interface and port (e.g., port 80 or 443): tcpdump -i eth0 -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
• Use curl or similar tools to test the endpoint with crafted non-UTF-8 select-asn parameters to verify if the service crashes.

Note that no specific detection commands are provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to install Routinator version 0.15.2 or later, which contains the fix for this vulnerability.

Additionally, restrict API access to trusted networks only, as the vulnerability only affects users who allow API access from untrusted networks.

Useful 0 Not Useful 0