Denial of Service in Rowboat up to 0.9.1

Executive Summary

This is a denial of service (DoS) vulnerability in Rowboat versions up to 0.9.1. It affects the Composio webhook endpoint, where the function request.text/req.json reads and logs the entire HTTP request body before verifying authentication or signatures. Attackers can send oversized payloads, causing excessive memory allocation and process crashes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusually large HTTP request bodies being sent to the Composio webhook endpoint or API chat route. Check for excessive memory usage or crashes in the Rowboat process. Use network traffic analysis tools like tcpdump or Wireshark to inspect request sizes and patterns targeting the vulnerable endpoints.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to crash the Rowboat process by sending a large request, leading to service unavailability. This may degrade performance, fill log files, and prevent normal requests from being processed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial of service attacks that degrade system availability. GDPR requires maintaining service availability, while HIPAA mandates access to protected health information systems. Exploits causing crashes or resource exhaustion may violate these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to Rowboat version 0.9.2 or later to resolve the issue. If upgrading is not possible, implement request body size limits before parsing, verify webhook signatures early, avoid logging full payloads, and move authorization checks before parsing. Add strict schema limits and rate limiting to prevent oversized requests.

Useful 0 Not Useful 0