GHSA-qvxg-wjxc-r4gg

Vapor vulnerable to denial of service in URLEncodedFormDecoder

Vapor is an HTTP web framework for Swift. Vapor versions earlier than 4.61.1 are vulnerable to a denial of service in the URLEncodedFormDecoder. ### Impact When using automatic content decoding, e.g. ```swift app.post("foo") { request -> String in let foo = try request.content.decode(Foo.self) return "\(foo)" } ``` An attacker can craft a request body that can make the server crash with the following request: ``` curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo ``` The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow. ### Patches Fixed in 4.61.1 ### Workarounds If you don't need to decode Form URL Encoded data, you can disable the `ContentConfiguration` so it won't be used. E.g. in **configure.swift** ```swift var contentConfig = ContentConfiguration() contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .json) contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .json) contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .jsonAPI) contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .jsonAPI) ContentConfiguration.global = contentConfig ``` ### For more information If you have any questions or comments about this advisory: * Open an issue in [the Vapor repo](https://github.com/vapor/vapor) * Ask in [Vapor Discord](http://vapor.team)