#39395 [BC-Medium] got.get without response limit

Submitted on Jan 29th 2025 at 12:46:04 UTC by @riproprip for Audit Comp | Shardeum: Core III

  • Report ID: #39395

  • Report Type: Blockchain/DLT

  • Report severity: Medium

  • Target: https://github.com/shardeum/shardus-core/tree/bugbounty

  • Impacts:

    • Network not being able to confirm new transactions (total network shutdown)

Description

Brief/Intro

Core uses the method get of the got module to initiate a http get. It does not limit the response size. This allows attackers to use up all the memory on the system till the node crashes.

Vulnerability Details

got.get should be called with a response limit. Since a limit is not supplied and got allows compressed responses, the counterparty can return a bunch of compressed 0s to use very little bandwith/transfer volume/resources to crash a node.

Please note that while the attacker does not initiate the attack itself, the victim has to make contact with rotating random nodes and at least one of the archivers to function (giving attackers the option to strike).

Impact Details

Usually just the node process gets killed. In rare cases the OS also kills other processes.

References

The offending line

Proof of Concept

Proof of Concept

I wasn't really sure what hurdle to jump here. Below we reroute all got requests to a malicious server. This server reroutes all requests to the intended counterparty, unless a got.get request was made and more than 120 seconds elapsed. In that case it sends the compressed 0's which crashes the node. Be careful when running the POC, your system will become unresponsive when all the memory is used till the OS steps in and reaps.

I attached a screenshot.

save as /tmp/malicious_server.js

save as /tmp/got.patch

save as /tmp/compressed_34.json

run

Was this helpful?