Description

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Impact

Who is impacted:

Any application using Zapros to make HTTP requests to untrusted servers

Applications that follow redirects to attacker-controlled hosts

Attack vector:

A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, it creates a deeply nested decompression chain consuming excessive resources.

Patches

Fixed in version 0.14.0.

The fix adds a hardcoded limit of 5 Content-Encoding layers. Responses exceeding this limit raise DecodingError.

Workarounds

Add middleware that checks for a malicious Content-Encoding header.

from typing import cast

from zapros import (
    AsyncBaseHandler,
    AsyncBaseMiddleware,
    BaseHandler,
    BaseMiddleware,
    Client,...
Show more

Mitigation

Aliases

References