okhttp-client-brotli-dos.md

description	title	date_published	last_updated	xray_id	vul_id	cvss	severity	discovered_by	type
CVE-2023-3782, MEDIUM, OkHttp client Brotli DoS	OkHttp client Brotli DoS	2023-07-19	2023-07-19	XRAY-526161	CVE-2023-3782	5.9	medium	Omer Kaspi	vulnerability

Summary

DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response

Component

com.squareup.okhttp3:okhttp-brotli

Affected versions

(,)

Description

A DoS issue lies in the intercept() function, if the user added BrotliInterceptor as an interceptor and does not add content encoding, the okhttp client will add the http header for Brotli encoding and will automatically try to decompress responses. The code does not guard against decompression bombs, which could crash the process due to memory exhaustion. With Brotli a file that weight several KBs can be decompressed into 10GB.

PoC

The following client code will crash when surfing to an HTTP server that serves a Brotli zip bomb -

import okhttp3.Call;
import okhttp3.OkHttpClient;
import okhttp3.Request;
import okhttp3.Response;
import okhttp3.brotli.BrotliInterceptor;
import java.io.IOException;
public class JavassistIntTruncationExample
{
public static void main(String argv[]) throws IOException {
    OkHttpClient client = new OkHttpClient.Builder()
            .addInterceptor(BrotliInterceptor.INSTANCE)
            .build();
    Request request = new Request.Builder()
            .url("http://127.0.0.1:8080")
            .build();
    Call call = client.newCall(request);
    Response response = call.execute();
    System.out.println(response.body().bytes().length);
}
}

Vulnerability Mitigations

Remove any usage of the BrotliInterceptor class. If Brotli functionality is needed, a fixed version of the class can be found here

References

square/okhttp#7738