CVE-2022-25761: Allocation of Resources Without Limits or Throttling (CWE-770)
value: The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2022-08-23T05:15Z
Repository: https://github.com/open62541/open62541
Language: C
Files changed: plugins/ua_config_default.c, tests/check_securechannel.c
Commit date: 2022-06-04 15:09:28 +0200
Commit message: fix(plugin): Add default limits for chunks and message size

Based on a reported DoS vulnerability reported by Team82 (Claroty
Research).

Diff: diff --git a/plugins/ua_config_default.c b/plugins/ua_config_default.c
index bad2e2a60..04e51eb4c 100644
--- a/plugins/ua_config_default.c
+++ b/plugins/ua_config_default.c
@@ -57,17 +57,17 @@ UA_Server_new() {
 /*******************************/
 /* Default Connection Settings */
 /*******************************/
 
 const UA_ConnectionConfig UA_ConnectionConfig_default = {
-    0,     /* .protocolVersion */
-    65535, /* .sendBufferSize, 64k per chunk */
-    65535, /* .recvBufferSize, 64k per chunk */
-    0,     /* .localMaxMessageSize, 0 -> unlimited */
-    0,     /* .remoteMaxMessageSize, 0 -> unlimited */
-    0,     /* .localMaxChunkCount, 0 -> unlimited */
-    0      /* .remoteMaxChunkCount, 0 -> unlimited */
+    0,       /* .protocolVersion */
+    2 << 16, /* .sendBufferSize, 64k per chunk */
+    2 << 16, /* .recvBufferSize, 64k per chunk */
+    2 << 29, /* .localMaxMessageSize, 512 MB */
+    2 << 29, /* .remoteMaxMessageSize, 512 MB */
+    2 << 14, /* .localMaxChunkCount, 16k */
+    2 << 14  /* .remoteMaxChunkCount, 16k */
 };
 
 /***************************/
 /* Default Server Settings */
 /***************************/
diff --git a/tests/check_securechannel.c b/tests/check_securechannel.c
index 0945cd408..e7fc6ef49 100644
--- a/tests/check_securechannel.c
+++ b/tests/check_securechannel.c
@@ -43,11 +43,12 @@ static void
 setup_secureChannel(void) {
     TestingPolicy(&dummyPolicy, dummyCertificate, &fCalled, &keySizes);
     UA_SecureChannel_init(&testChannel, &UA_ConnectionConfig_default);
     UA_SecureChannel_setSecurityPolicy(&testChannel, &dummyPolicy, &dummyCertificate);
 
-    testingConnection = createDummyConnection(65535, &sentData);
+    testingConnection =
+        createDummyConnection(UA_ConnectionConfig_default.sendBufferSize, &sentData);
     UA_Connection_attachSecureChannel(&testingConnection, &testChannel);
     testChannel.connection = &testingConnection;
 
     testChannel.state = UA_SECURECHANNELSTATE_OPEN;
 }

Vulnerable code:     0,     /* .protocolVersion */
    65535, /* .sendBufferSize, 64k per chunk */
    65535, /* .recvBufferSize, 64k per chunk */
    0,     /* .localMaxMessageSize, 0 -> unlimited */
    0,     /* .remoteMaxMessageSize, 0 -> unlimited */
    0,     /* .localMaxChunkCount, 0 -> unlimited */
    0      /* .remoteMaxChunkCount, 0 -> unlimited */
    testingConnection = createDummyConnection(65535, &sentData);
Fixed code:     0,       /* .protocolVersion */
    2 << 16, /* .sendBufferSize, 64k per chunk */
    2 << 16, /* .recvBufferSize, 64k per chunk */
    2 << 29, /* .localMaxMessageSize, 512 MB */
    2 << 29, /* .remoteMaxMessageSize, 512 MB */
    2 << 14, /* .localMaxChunkCount, 16k */
    2 << 14  /* .remoteMaxChunkCount, 16k */
    testingConnection =
        createDummyConnection(UA_ConnectionConfig_default.sendBufferSize, &sentData);