CVE-2023-32731 Information leak in gRPC
An HPACK desynchronization flaw in gRPC allows attackers to leak headers between clients, potentially enabling data exfiltration or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32731?
CVE-2023-32731 is a high-severity vulnerability in Google gRPC, published on 9 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration. We recommend upgrading beyond the commit contained in https://github.com/grpc/grpc/pull/33005 https://github.com/grpc/grpc/pull/33005
Weakness: CWE-440
Which versions are affected by CVE-2023-32731?
13 open source packages ship an affected version, including grpcio, io.grpc:grpc-protobuf and grpc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grpcio PyPI | From 1.53.0 | 1.53.1, 1.54.2 |
grpcio PyPI | From 1.53.0 | 1.53.1 |
grpcio PyPI | From 1.53.0 | 1.53.1 |
grpcio PyPI | From 1.54.0 | 1.54.2 |
grpcio PyPI | From 1.54.0 | 1.54.2 |
io.grpc:grpc-protobuf Maven | From 1.53.0 | 1.53.1 |
7 more packages
io.grpc:grpc-protobuf Maven | From 1.53.0 | 1.53.1 |
io.grpc:grpc-protobuf Maven | From 1.54.0 | 1.54.2 |
io.grpc:grpc-protobuf Maven | From 1.54.0 | 1.54.2 |
grpc RubyGems | From 1.53.0 | 1.53.1 |
grpc RubyGems | From 1.53.0 | 1.53.1 |
grpc RubyGems | From 1.54.0 | 1.54.2 |
grpc RubyGems | From 1.54.0 | 1.54.2 |
Products include Grpc Grpc.
How do I fix CVE-2023-32731?
Upgrade grpcio to a fixed version for your release line: 1.53.1 or 1.54.2.
Is CVE-2023-32731 being exploited?
There is no known exploitation of CVE-2023-32731 in the wild and no public exploit code.
Other vulnerabilities in Google gRPC
Sources
Also known as BELL-CVE-2023-32731, GHSA-cfgp-2977-2fmm, PYSEC-2026-1427, UBUNTU-CVE-2023-32731.