GHSA-53mj-mc38-q894 Remote Memory Exposure in openwhisk

Not scored Published 1 Sep 2020

An attacker can trigger remote memory exposure in the OpenWhisk library by supplying a number as the API key, leaking uninitialized memory contents.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-53mj-mc38-q894?

GHSA-53mj-mc38-q894 is a vulnerability in openwhisk, published on 1 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Versions of openwhisk before 3.3.1 are vulnerable to remote memory exposure.

When a number is passed to api_key, affected versions of openwhisk allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded).

Proof of concept:

var openwhisk = require(&#39;openwhisk&#39;);
var options = {
  apihost: &#39;127.0.0.1:1433&#39;, 
  api_key: USERSUPPLIEDINPUT // number
};
var ow = openwhisk(options);
ow.actions.invoke({actionName: &#39;sample&#39;}).then(result =&gt; console.log(result))

Recommendation

Update to version 3.3.1 or later.

Which versions are affected by GHSA-53mj-mc38-q894?

2 open source packages ship an affected version, including openwhisk.

Package	Affected	Fixed in
`openwhisk` npm	All versions	`3.3.1`
`openwhisk` npm	All versions	`3.3.1`

How do I fix GHSA-53mj-mc38-q894?

Upgrade openwhisk to 3.3.1 or later.

Is GHSA-53mj-mc38-q894 being exploited?

There is no known exploitation of GHSA-53mj-mc38-q894 in the wild and no public exploit code.