Vulnerability · Published Mar 9, 2021 · Assigned by GitHub_M
CVE-2021-21369Potential DoS in Besu HTTP JSON-RPC API
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in besu from hyperledger. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Official description
Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requests (incorrect password). As the supplied password is checked for validity on the main vertx event loop and takes a relatively long time this can cause the processing of other valid requests to fail. A valid username is required for this vulnerability to be exposed. This has been fixed in version 1.5.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hyperledger | besu | < 1.5.1 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/hyperledger/besu/security/advisories/GHSA-qgfj-mjpc-7w3q x_refsource_CONFIRM
- https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151 x_refsource_MISC
- https://github.com/hyperledger/besu/pull/1144 x_refsource_MISC
- https://github.com/hyperledger/besu/commit/06e35a58c07a30c0fbdc0aae45a3e8b06b53c022 x_refsource_MISC