facil.io HTTP/1.1 Chunked Transfer Encoding DoS Vulnerability

Executive Summary

This is a denial-of-service vulnerability in the facil.io library versions 0.7.5 through 0.7.6. It involves the HTTP/1.1 chunked transfer encoding parser incorrectly handling negative chunk size values. When an attacker sends a POST request with a negative chunk size (e.g., a leading minus sign in the chunk size field), the parser converts it into a large positive integer, corrupting internal state and causing the read pointer to access unmapped memory, resulting in a server crash.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in facil.io servers after receiving POST requests with Transfer-Encoding: chunked headers containing negative chunk sizes. Use network traffic analysis tools like Wireshark to inspect HTTP requests for malformed chunked encoding. Check server logs for segmentation faults or memory access violations following such requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to crash the server by sending a single malicious POST request. The impact includes server downtime, denial of service for legitimate users, and potential disruption of services relying on the facil.io library for HTTP/1.1 chunked transfer encoding.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to a patched version of facil.io if available. If not, implement input validation to reject negative chunk sizes in the HTTP/1.1 parser. Temporarily block malformed requests using a web application firewall or reverse proxy. Disable chunked transfer encoding if not required by your application.

Useful 0 Not Useful 0