Contrast Panic in Transit-Engine Endpoint via Short Ciphertext

Executive Summary

Contrast through 1.20.0 has a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function. It fails to validate the length of decoded ciphertext before slicing, causing a runtime panic when a short base64-encoded ciphertext is submitted. This leads to log spam and request failures without crashing the process.

Useful 0 Not Useful 0

Detection Guidance

Monitor logs for panic errors in the transit-engine endpoint of Contrast versions up to 1.20.0. Check for repeated 500 responses or log spam from short base64-encoded ciphertext submissions. Use network traffic analysis to detect unusual requests targeting the ciphertextContainer.UnmarshalJSON function.

Useful 0 Not Useful 0

Impact Analysis

An authenticated attacker with a valid mesh certificate can repeatedly trigger this vulnerability, causing log spam, request failures, and increased CPU usage. While the process remains stable, it results in a slow denial-of-service attack against the transit-engine endpoint.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) by triggering runtime panics in the transit-engine endpoint, leading to log spam and request failures without crashing the process. While it does not directly expose sensitive data, the resulting log noise and service disruption could interfere with audit logging required by GDPR and HIPAA. The DoS condition may also impact system availability, a key requirement under both regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Contrast to a patched version beyond 1.20.0. Apply the GitHub Security Advisory fix (GHSA-3ccm-4qq2-5wrp). Validate ciphertext length in the ciphertextContainer.UnmarshalJSON function before slicing. Restrict access to the transit-engine endpoint to trusted workloads only.

Useful 0 Not Useful 0