Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

POST on /sys/leases/lookup endpoint with specific payload causes internal server error #11314

Closed
matusf opened this issue Apr 8, 2021 · 1 comment
Assignees
Labels
bug Used to indicate a potential bug core Issues and Pull-Requests specific to Vault Core

Comments

@matusf
Copy link

matusf commented Apr 8, 2021

Describe the bug
Making a POST request on /sys/leases/lookup with specific payload causes internal server error

To Reproduce
Hi, I was fuzzing vault and found this bug. To reproduce it, just run vault server -dev and make a request. The request is described in enclosed zip (single JSON file inside). The JSON has also the curl formated of the request, however, the request contains some wild unicode characters that your terminal may not like (at least mine does not 😄). Therefore is better to use the resender utility that I made (along with the fuzzer). You may find it in my repo (github.com/matusf/openapi-fuzzer), with all installation instructions. Basically just run openapi-fuzzer-resender file.json to make the request.

sys-leases-lookup.zip
In the request is vault token supplied in the headers, however, it's not needed to reproduce this crash.

See error from request: {"errors":["no namespace"]}
In logs:

[WARN]  core: error looking up namespace from the token's namespace ID: error="no namespace"

This issue might be related to #11306, #11308 and #11313 as there is the same response & log message.

Expected behavior
Response with non 500 status code.

Environment:

  • Vault Server Version (retrieve with vault status):
{
    "cluster_id": "ff96e72d-8a50-1574-3044-567db781e3c3",
    "cluster_name": "vault-cluster-f4d3b0c5",
    "initialized": true,
    "migration": false,
    "n": 1,
    "nonce": "",
    "progress": 0,
    "recovery_seal": false,
    "sealed": false,
    "storage_type": "inmem",
    "t": 1,
    "type": "shamir",
    "version": "1.7.0-rc1"
}
  • Vault CLI Version (retrieve with vault version): Vault v1.7.0-rc1 (9af08a1c5f0f855984a1fa56d236675d167f578e)
  • Server Operating System/Architecture: Ubuntu 18.04/x86_64
@sgmiller sgmiller added auth/approle bug Used to indicate a potential bug core Issues and Pull-Requests specific to Vault Core and removed auth/approle labels May 10, 2021
@aphorise
Copy link
Contributor

aphorise commented Sep 4, 2022

Closing as report was likely specific to the RC version when this was reported. Retesting in 1.10.5 all looks fine - eg:

curl -v -X POST -d '{"lease_id":"昦􊷋񧮷󭛵񪹁򎻁񴡪򞟬񏌁񙐬󭉶󇃃󥻷𢮕򞊯.򎻈뵸𳽭񙧵󍲢򻞏𸑀񔢏򨋦񞆷򊈎󨡢訁󓋐􆰍񘅽򭿝򸷣󣏼󓿔񸲙󗲆󩍻𵴺񕸤􎑞󞮃󲁘󺻟𱃸󱲎𺼿𿟶󋷋񱳨󈧍󝶟񸗩󩻏󐊞𹶽񠞡񓾂󞿃󘷸񜺾򫢒󋴞􈿂ᇪ𿧢񁜯𸓔񼥅􅿢𯒪𲅶󰻣𳁤񖯗񒰑󫦻󠿯􈏡򞽩ꟾ􃏕򜶛󈺸򧷐񜛫񣖣󣋑󅘧􄌦󘸼򩾒󧏊񐉫򇼟񋕦󼂃𼹗􃽆󁱷􄁖𼀅򣪵򢞖󤤆󺨁󍘜񈆱񌶛򸒾󥥰򊴺񲈛🄖󌢆󞸭󪣎󴽬曱񅂣󫋌񟍩񘯚򇊎񁹉򠒣򃀼򊳙񔞵񪼊򲾇򍣩𖗨󎤬񄕰񣷩򀘢􀢎񍢜򞃸򥛌󐧏醙𡒴󟪘򽁑񅁭񳯘򹌗񃃠񰖕󕔒񍻹򭿫󠸂򓧂򝾄󝳯񣵩󥫆󥮹󟋘񽔇𗅊򃪞Ṯ򶠓񻮒􁯪򄯁񳇿󞰯𾋢󍺱󷮩񀩕𬥌匳򢇆񸐚𧎏񌮻򋿣󨞓􌽓𙛲󛧸򊼍󘏤󄜇𭌡񼜑󆸑󑞝򄱍񣵨󸦞󪁨󯖬񊟤򘀙㳪𱀖􏆃񐏫𳮾򤵝򵌿󤃈󨨌򒘇𩲝󋩛𱲑󟪔񟺑򕵎𤧒򚓃񦾒񍌷򦚲񗪹󭨶򡅑㓼󹨍񪖂񩆈򣋷񜞍򞶊𡦙򬟴򗃐󓘒񠄇􉡬󌣰񍕡󰘀硢𑕓􅊬𱓕򩕃񝶠𢑀򠹀򅫦񅈮𶡘󥁙򠂲찓񊲩𜧞󪹠⫣􈬿򘤡𑦠򩕥񒢼󿺪𯋒􀊫򯸫󿕮򲓵򯁀񯢶񽍽򸁟𽯩񥊐񶼩𱊂񗒸󬿗򺷗ࣼ󉎃󽤌󄼻󁝱񱣱󺣎󚔀򎬸󝠔􈅯󃌐󆿇񄦕󺔟򑏕񧘟񏠗򃶩𔌭𘁍󴸥񮤵󝲓񂞱𕕶⿮𷂃󊫜񱪈񈞊􊶄󆹣񯆴􂈬𨃸󪸯񱍰񸨳ᮞ󣼊󎒬𧫒񖦒񽤁򼗕򹖾󽦾񙪰􂿎𥎫򓔶򞪐𰙖񛶪򺤘󙺐󥹨򬅩󊚛񭣴󣰺􏜼󵎙񘿔󯻡򥦖񃍼󫋖󆷻𸗧𰫛򗞸񦎠󓻔ቄ𽬟񫝏󷘖񎘗𽆤󃩜𹅰򾌏򻆞񌤵򋦥򚔖򎥅𨳡򅤊񄊿򂴒񟈧􅊽󼒒󵉯񠂢󸂲󡬂򪽜򚳼󤨯󎳚񡕙򰈘񚅮𞭇򎙜𻙇񩢻򀩽󨂖󍎌𡑜􊏞򯟲󓎃񈅨񉝨󂷥񫰱􌜘􏨪𙼤𨕉񆡓񨎗򋵉򍼕𖖯򖛶򥧉󇨣񈡹𲵃򚑼򜯷𪍃𰵅𗎡򃨭췿񑏷󟛿񞶝򫰎񑢦𪋬􍨡៶񽡾򡤌򵠂𕆞򝶷򀺛󾗋𴮳𤤎󼽭󇿥񭦎񌽈򖐺欴󀘧厓񯣄󥎛񢑶𨿬򰒡򈂅򋘫򉑞󌎖򜽊󌶒򸱈􉏏􈿅􉎈󰗷󦾐详󞴊񲿟𻕜𠖜󣅅𮼎󒡂򐌑𲸲򪻂󯻕󔇢󜫗򎗊𶿥𨇑𶷗攍󭋔򪝱󍐺򲒒񰂲𮍁󫫋𤖫񱀭󜘍񂎛򢎼󰢚󸅢񥼮񣝽񒟓⑰񃱫􈇓񪟙񘪟򺚭򲴷톉򰮎񐏂𯅳򼫒񛃊󨭫󤫑󊰣򼜭񟱽􊯡񊨻񃂢𯉂󬊡򻥵􋙒񀥁򊖏򚶜򍣯򚱣򇅟󦩤񺜫𖼮󗀫񣴊򯿆񺊿򫴱񡧬񄊕󫒆񳣘𖗹𴍇򻞔󖷃𲝮󯹨󬂊򯄏󎮪󑁶򲥧񶒔񕀓򳄡󿸢򀸰񬢠󦩰񃒮򡾯􆗼򜧌񯾋󒎠𙗇𾤘򣟟񬊢񕔽򋜔񞙺𹚨񏍲𗭄䵍󞺘񓇥򫽍􌬡򔺥𢉉﨣򼟯􅥣󠒻񷎱񛏷􏲤󈜷􀕞񏵂睜󜖾󤅒􍃦󧫟𕩟򠉙𴪽𵷠򙬙󙾓񼈽򎺌򋪪񚀐󪻾ཽ󁤎󖃷𠴿𹘧𬮨򨳋򀁯񘕾򄚫𬢊񰠥򦫵𤻗񘮯巳򓲩򣊖򷼈򹙱񿆕􄙔𤀙񳁂󜖂󐥢󛙱󼇚𽰱𬰛𫵌񨁼󋼝񘯵𗢌󾹮񁗍󲉚򓖦񾐹񲗬񠈀򚤞򺴧"}' -H 'X-Vault-Token: ${VAULT_TOKEN}' ${VAULT_ADDR}/v1/sys/leases/lookup
  # < HTTP/2 403
  # # // ...
  # {"errors":["permission denied"]}

Thanks @matusf

@aphorise aphorise closed this as completed Sep 4, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Used to indicate a potential bug core Issues and Pull-Requests specific to Vault Core
Projects
None yet
Development

No branches or pull requests

4 participants