CVE-2021-21369 Potential DoS in Besu HTTP JSON-RPC API
An attacker can cause denial of service in Hyperledger Besu by overloading the login endpoint with invalid credentials when authentication is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21369?
CVE-2021-21369 is a medium-severity denial of service vulnerability in hyperledger besu, published on 9 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requests (incorrect password). As the supplied password is checked for validity on the main vertx event loop and takes a relatively long time this can cause the processing of other valid requests to fail. A valid username is required for this vulnerability to be exposed. This has been fixed in version 1.5.1.
Weakness: CWE-400
Which versions are affected by CVE-2021-21369?
It affects 1 product.
Products include Linuxfoundation Besu.
How do I fix CVE-2021-21369?
No fix has been published for CVE-2021-21369 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-21369 being exploited?
There is no known exploitation of CVE-2021-21369 in the wild and no public exploit code.
Other vulnerabilities in hyperledger besu
Sources
Also known as GHSA-qgfj-mjpc-7w3q.