Merge pull request #2181 from BishopFox/fix/gzip-bomb

Add limit to gzip size

Author: moloch--

server/c2/http.go

@@ -68,12 +68,12 @@ var (
 )
 
 const (
-	DefaultMaxBodyLength   = 2 * 1024 * 1024 * 1024 // 2Gb
-	DefaultMaxUnauthBodyLength = 8 * 1024 * 1024   // 8Mb
-	DefaultHTTPTimeout     = time.Minute
-	DefaultLongPollTimeout = time.Second
-	DefaultLongPollJitter  = time.Second
-	minPollTimeout         = time.Second
+	DefaultMaxBodyLength       = 2 * 1024 * 1024 * 1024 // 2Gb
+	DefaultMaxUnauthBodyLength = 8 * 1024 * 1024        // 8Mb
+	DefaultHTTPTimeout         = time.Minute
+	DefaultLongPollTimeout     = time.Second
+	DefaultLongPollJitter      = time.Second
+	minPollTimeout             = time.Second
 )
 
 var (
@@ -574,7 +574,7 @@ func (s *SliverHTTPC2) startSessionHandler(resp http.ResponseWriter, req *http.R
 		s.defaultHandler(resp, req)
 		return
 	}
-	data, err := encoder.Decode(body)
+	data, err := decodeReqBodyWithMaxLen(encoder, body, int64(DefaultMaxUnauthBodyLength))
 	if err != nil {
 		httpLog.Errorf("Failed to decode body %s", err)
 		s.defaultHandler(resp, req)
@@ -720,7 +720,7 @@ func (s *SliverHTTPC2) readReqBody(httpSession *HTTPSession, resp http.ResponseW
 		return nil, err
 	}
 
-	data, err := encoder.Decode(body)
+	data, err := decodeReqBodyWithMaxLen(encoder, body, int64(DefaultMaxBodyLength))
 	if err != nil {
 		httpLog.Warnf("Failed to decode body %s", err)
 		s.defaultHandler(resp, req)
@@ -735,6 +735,13 @@ func (s *SliverHTTPC2) readReqBody(httpSession *HTTPSession, resp http.ResponseW
 	return plaintext, err
 }
 
+func decodeReqBodyWithMaxLen(encoder sliverEncoders.Encoder, body []byte, maxDecodedLen int64) ([]byte, error) {
+	if limitedDecoder, ok := encoder.(sliverEncoders.LimitedDecoder); ok {
+		return limitedDecoder.DecodeWithMaxLen(body, maxDecodedLen)
+	}
+	return encoder.Decode(body)
+}
+
 func (s *SliverHTTPC2) getServerPollTimeout() time.Duration {
 	min := s.ServerConf.LongPollTimeout
 	max := s.ServerConf.LongPollTimeout + s.ServerConf.LongPollJitter

util/encoders/encoders.go

@@ -38,6 +38,11 @@ type Encoder interface {
 	Decode([]byte) ([]byte, error)
 }
 
+// LimitedDecoder - Decoders that can enforce a max output length while decoding.
+type LimitedDecoder interface {
+	DecodeWithMaxLen(data []byte, maxLen int64) ([]byte, error)
+}
+
 // EncoderFS - Generic interface to read wasm encoders from a filesystem
 type EncoderFS interface {
 	Open(name string) (fs.File, error)

util/encoders/gzip.go

@@ -21,12 +21,16 @@ package encoders
 import (
 	"bytes"
 	"compress/gzip"
+	"fmt"
+	"io"
 	"sync"
 )
 
 // Gzip - Gzip compression encoder
 type Gzip struct{}
 
+const DefaultMaxGzipDecodeLen = 2 * 1024 * 1024 * 1024 // 2GB
+
 var gzipWriterPools = &sync.Pool{}
 
 func init() {
@@ -80,14 +84,33 @@ func (g Gzip) Encode(data []byte) ([]byte, error) {
 
 // Decode - Uncompressed data with gzip
 func (g Gzip) Decode(data []byte) ([]byte, error) {
+	return g.DecodeWithMaxLen(data, DefaultMaxGzipDecodeLen)
+}
+
+// DecodeWithMaxLen - Uncompress data with gzip while enforcing a max output size.
+func (g Gzip) DecodeWithMaxLen(data []byte, maxLen int64) ([]byte, error) {
+	if maxLen < 0 {
+		return nil, fmt.Errorf("invalid max decode length: %d", maxLen)
+	}
+
 	reader, err := gzip.NewReader(bytes.NewReader(data))
 	if err != nil {
 		return nil, err
 	}
+	defer reader.Close()
+
+	limitedReader := &io.LimitedReader{
+		R: reader,
+		N: maxLen + 1,
+	}
+
 	var buf bytes.Buffer
-	_, err = buf.ReadFrom(reader)
+	_, err = buf.ReadFrom(limitedReader)
 	if err != nil {
 		return nil, err
 	}
+	if limitedReader.N == 0 {
+		return nil, fmt.Errorf("gzip decoded payload exceeds %d bytes", maxLen)
+	}
 	return buf.Bytes(), nil
 }

util/encoders/gzip_test.go

@@ -58,3 +58,34 @@ func TestGzipGunzip(t *testing.T) {
 		}
 	}
 }
+
+func TestGzipDecodeWithMaxLen(t *testing.T) {
+	payload := bytes.Repeat([]byte("A"), 8192)
+	gzip := new(Gzip)
+	encoded, err := gzip.Encode(payload)
+	if err != nil {
+		t.Fatalf("gzip encode failed: %v", err)
+	}
+
+	decoded, err := gzip.DecodeWithMaxLen(encoded, int64(len(payload)))
+	if err != nil {
+		t.Fatalf("gzip decode failed: %v", err)
+	}
+	if !bytes.Equal(payload, decoded) {
+		t.Fatal("decoded payload does not match original")
+	}
+}
+
+func TestGzipDecodeWithMaxLenRejectsOversizedOutput(t *testing.T) {
+	payload := bytes.Repeat([]byte("A"), 8192)
+	gzip := new(Gzip)
+	encoded, err := gzip.Encode(payload)
+	if err != nil {
+		t.Fatalf("gzip encode failed: %v", err)
+	}
+
+	_, err = gzip.DecodeWithMaxLen(encoded, int64(len(payload)-1))
+	if err == nil {
+		t.Fatal("expected decode to fail for oversized payload")
+	}
+}