NULL Pointer Dereference in fastschema

Executive Summary

This is a NULL pointer dereference vulnerability in fastschema through version 0.15.1. An unauthenticated remote attacker can crash the server by sending a single HTTP request. The issue occurs in the sendOTPEmail function in pkg/auth/local.go, where a pointer from an unchecked error path is dereferenced without validation, causing a fatal panic that terminates the server when a recovery request is sent to the /api/auth/local/recover endpoint.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or panics in the fastschema server process after sending a recovery request to the /api/auth/local/recover endpoint. Check server logs for fatal errors or NULL pointer dereference messages following such requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to crash the fastschema server remotely without authentication. This results in a denial of service (DoS), making the application unavailable to legitimate users. The server process terminates entirely upon exploitation, disrupting services dependent on it.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes server crashes via unauthenticated requests, leading to denial-of-service conditions. Such instability may disrupt data availability, potentially violating GDPR's integrity and availability principles or HIPAA's access and integrity requirements for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update fastschema to a patched version if available. If not, restrict access to the /api/auth/local/recover endpoint via network policies or firewall rules. Monitor server logs for signs of exploitation attempts.

Useful 0 Not Useful 0