CVE-2019-3552 (published 2019-05-06T16:29Z)

C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/facebook/fbthrift
commit_details: repo_url: https://github.com/facebook/fbthrift
author: Stepan Palamarchuk
author_date: 2019-02-14 13:37:15-08:00
msg: Throw on bad types during skipping data

Summary:
The current code silently returns on bad types. In case when we have an invalid data, we may get a container of a large size with a bad type, this would lead to us running long loop doing nothing (though we already can say that the data is invalid).

The new code would throw an exception as soon as we try to skip a value of invalid type.

Fixes CVE-2019-3552

Reviewed By: yfeldblum, stevegury

Differential Revision: D8344920

fbshipit-source-id: f12e8f3442f7ad5e1a81d822380701e929b80f0d
repository: repo_url: https://github.com/facebook/fbthrift
repo_name: facebook/fbthrift
description: Facebook's branch of Apache Thrift, including a new C++ server.
repo_language: C++
owner: facebook
file_changes: filename: TProtocolException.cpp
change_type: ModificationType.MODIFY
diff: @@ -57,4 +57,12 @@ namespace apache { namespace thrift { namespace protocol {
           "Attempt to interpret value {} as bool, probably the data is corrupted",
           value));
 }
+
+[[noreturn]] void TProtocolException::throwInvalidSkipType(TType type) {
+  throw TProtocolException(
+      TProtocolException::INVALID_DATA,
+      folly::sformat(
+          "Encountered invalid field/element type ({}) during skipping",
+          static_cast<uint8_t>(type)));
+}
 }}}

programming_language: C++
filename: TProtocolException.h
change_type: ModificationType.MODIFY
diff: @@ -23,6 +23,7 @@
 #define _THRIFT_PROTOCOL_TPROTOCOLEXCEPTION_H_ 1
 
 #include <thrift/lib/cpp/Thrift.h>
+#include <thrift/lib/cpp/protocol/TType.h>
 
 #include <string>
 
@@ -106,6 +107,7 @@ class TProtocolException : public apache::thrift::TLibraryException {
       folly::StringPiece field,
       folly::StringPiece type);
   [[noreturn]] static void throwBoolValueOutOfRange(uint8_t value);
+  [[noreturn]] static void throwInvalidSkipType(TType type);
 
  protected:
   /**

programming_language: C++
filename: Protocol.h
change_type: ModificationType.MODIFY
diff: @@ -176,8 +176,9 @@ void skip(Protocol_& prot, TType arg_type) {
       prot.readListEnd();
       return;
     }
-    default:
-      return;
+    default: {
+      TProtocolException::throwInvalidSkipType(arg_type);
+    }
   }
 }
 

programming_language: C++
filename: TProtocol.py
change_type: ModificationType.MODIFY
diff: @@ -177,9 +177,7 @@ class TProtocolBase:
         pass
 
     def skip(self, type):
-        if type == TType.STOP:
-            return
-        elif type == TType.BOOL:
+        if type == TType.BOOL:
             self.readBool()
         elif type == TType.BYTE:
             self.readByte()
@@ -220,6 +218,11 @@ class TProtocolBase:
             for _ in range(size):
                 self.skip(etype)
             self.readListEnd()
+        else:
+            raise TProtocolException(
+                TProtocolException.INVALID_DATA,
+                "Unexpected type for skipping {}".format(type)
+            )
 
     def readIntegral(self, type):
         if type == TType.BOOL:

programming_language: Python
filename: ProtocolSkipTest.cpp
change_type: ModificationType.ADD
diff: @@ -0,0 +1,68 @@
+/*
+ * Copyright 2004-present Facebook, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#include <thrift/lib/cpp2/protocol/CompactProtocol.h>
+
+using namespace apache::thrift;
+
+TEST(ProtocolSkipTest, SkipInt) {
+  IOBufQueue queue;
+  CompactProtocolWriter writer;
+  writer.setOutput(&queue);
+  writer.writeI32(123);
+  auto buf = queue.move();
+  CompactProtocolReader reader;
+  reader.setInput(buf.get());
+  reader.skip(TType::T_I32);
+}
+
+TEST(ProtocolSkipTest, SkipStop) {
+  IOBufQueue queue;
+  CompactProtocolWriter writer;
+  writer.setOutput(&queue);
+  writer.writeFieldStop();
+  auto buf = queue.move();
+  CompactProtocolReader reader;
+  reader.setInput(buf.get());
+  bool thrown = false;
+  try {
+    reader.skip(TType::T_STOP);
+  } catch (const TProtocolException& ex) {
+    EXPECT_EQ(TProtocolException::INVALID_DATA, ex.getType());
+    thrown = true;
+  }
+  EXPECT_TRUE(thrown);
+}
+
+TEST(ProtocolSkipTest, SkipStopInContainer) {
+  IOBufQueue queue;
+  CompactProtocolWriter writer;
+  writer.setOutput(&queue);
+  writer.writeListBegin(TType::T_STOP, 1u << 30);
+  auto buf = queue.move();
+  CompactProtocolReader reader;
+  reader.setInput(buf.get());
+  bool thrown = false;
+  try {
+    reader.skip(TType::T_LIST);
+  } catch (const TProtocolException& ex) {
+    EXPECT_EQ(TProtocolException::INVALID_DATA, ex.getType());
+    thrown = true;
+  }
+  EXPECT_TRUE(thrown);
+}

programming_language: Java