search

acouvreur / traefik-modsecurity-plugin

Traefik plugin to proxy requests to owasp/modsecurity-crs:apache container
https://plugins.traefik.io/plugins/628c9eadffc0cd18356a9799/modsecurity-plugin
Apache License 2.0
142 stars 25 forks source link

Resource exhaustion via crafted body #7

Closed Enrico204 closed 2 years ago

Enrico204 commented 2 years ago

Here the code is reading the body of the request: https://github.com/acouvreur/traefik-modsecurity-plugin/blob/19cdb477b8cee1966ad95278d168ae90a93df663/modsecurity.go#L63

The problem of this technique is that an attacker can issue a request using an arbitrary body size (1 terabyte) and crash the server, creating a Denial-of-Service.

A possible mitigation is reading the body while using http.MaxBytesReader() function, to limit the maximum body size. Possibly, the maximum size should be configurable.

I'm not aware of any other solution (with this middleware architecture, see https://github.com/acouvreur/traefik-modsecurity-plugin/issues/2#issuecomment-1205788329).

acouvreur commented 2 years ago

Its a good idea indeed, even though I believe we could mitigate this using another middleware.

But this middleware shouldm't include some vulnerabilities.