Panic when parsing invalid messages in google.golang.org/protobuf

Root

Cause

CVE-2023-24535 is a denial-of-service vulnerability in the Go protobuf library's text format parsing. The issue arises when the parser encounters a potential number consisting of a minus sign, one or more whitespace characters, and then no additional input. This causes the parser to panic, as it does not properly handle the incomplete numeric token after the minus sign [1][4].

Attack

Vector

An attacker who can supply a crafted text-format protobuf message to an application that parses it can trigger the panic. The attack requires no special privileges or authentication; the malformed message simply needs to be parsed by a vulnerable version of the protobuf library. The specific payload, as described in the report, is a line like s_int32: - # trailing space after - [4]. This is a text-format message field that starts with a minus sign, followed by whitespace (e.g., a space or tab), and then the input ends.

Impact

Successful exploitation causes the application to crash due to an unhandled panic. This constitutes a denial-of-service condition. The impact is limited to availability, but any service that parses protobuf text format from untrusted sources is vulnerable.

Mitigation

The vulnerability has been patched in the Go protobuf module. Users of the google.golang.org/protobuf or github.com/golang/protobuf module should update to a fixed version. The fix addresses the incomplete number parsing by handling the case where no digits follow the minus sign and whitespace [3]. No workaround other than updating is recommended.