hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management
https://www.vaultproject.io/
Other
30.98k stars 4.19k forks source link

POST on `/sys/leases/renew` endpoint with specific payload causes internal server error #11315

Closed matusf closed 2 years ago

matusf commented 3 years ago

Describe the bug Making a POST request on /sys/leases/renew with specific payload causes internal server error

To Reproduce Hi, I was fuzzing vault and found this bug. To reproduce it, just run vault server -dev and make a request. The request is described in enclosed zip (single JSON file inside). The JSON has also the curl formated of the request, however, the request contains some wild unicode characters that your terminal may not like (at least mine does not :smile:). Therefore is better to use the resender utility that I made (along with the fuzzer). You may find it in my repo (github.com/matusf/openapi-fuzzer), with all installation instructions. Basically just run openapi-fuzzer-resender file.json to make the request.

sys-leases-renew.zip In the request is vault token supplied in the headers, however, it's not needed to reproduce this crash.

See error from request: {"errors":["no namespace"]} In logs:

[WARN]  core: error looking up namespace from the token's namespace ID: error="no namespace"

This issue might be related to #11306, #11308, #11313 and #11314 as there is the same response & log message.

Expected behavior Response with non 500 status code.

Environment:

aphorise commented 2 years ago

Closing as retesting in 1.10.5 shows the expected response and no issues with 500 responses. Issue may have been specific to the RC version when this issue was raised.

curl -v -X POST -d '{"increment":-5424973945252039949,"lease_id":"󲽤󩟙񐈫𰻈􊁤򡪄󘾉𙒲񴋲򇌯򿔹󈐛񦛘𛿾󿊒󛣖ꕞ𚼃󊝊򨌟򽒅󻳹󝟙𦶹񓺔󿌩󛃘󌍨􋬪񅮨񼡼񏇆񷋌𲘿ㅹ򠀾񥗅񤣢񟙌󬛬󸣧򩚠򽮯񭪾󴿸󣝋𘯢󁻐𯉆򶛔񢋾󣟩񕪫򸭼𣁜򒽦󜙆񯒆򏀎󑰑󣡿𘀱󏦝􆖦򄞀񏮋㐏񊬨􉏏񮼮􏺕󖇖󣀷󆰳򛀉ꏬ󾰉𠯬󳘻󎨸񞧕󄁗􈁝񽽹򷵫󐷎򗃔󳜱񩿎򑱥󧥻􅺝񩹰􂬣𱪁򅞫󁙮󠴢򎺉񹩤󪭖󢿓񫿜򂀉򮃖𚙙񔏮򩫬𰩎󥋱𙈀񕻶񔰙񸧁񆡇񟴅񚼇򷤯򏠸񅄂𘿱򿧴𣷛򎳊򎻄񭒾񳀍𴩹򲠡󒭃򉩓󓑝Ќ򤋤򘭗󍳚񔺈󃃨󢿃򛪉𯼱𼿽򁫥󂮇򘁒𾦡󃂪񡂋񬸆񫔠󢙙󁵡𓐔󜇑󆽢򘌩񣣸򪣂󴷣򴓃򖍄󌯢򖌜𓥼𨕃񸽬񩙅𩄧󽞷𶐣򛏵󝻽𦻖񉜎󇼵􁳽󑰎񶐩𔝱򟭙󳦙𢿟򍎶󽚌󁰣񠆃􀻜ᄃ󹳰򐑌􉰗񛪾𮆆򴣵󺮕𚈩񢿞𼭬𫶗𥍳󜕫􉫋򝤰򡯗󗖧󺚴󔡎󹇹򓥷󜪶󢜒󝍱򄡦񣓖𗟰󅣪𷩲󢊂򄷈ᱩ񾇰𻓻򺾲򸸢􀧨򵓤􅏃򙌥󕤝󠱞󂬻򉫡𝊡񃭢񽩧򕵤𻡜𹚈󷨁󺝔󫷂𮳊󗖜􍔥񖏑񬋱񠑟񎕏񵙓񋥹𰇎񞹾􊍣󃫯󶲘㌃򄼿₠񓰌󒔛􊑒􎴎𾪏𲺰𕦣򶨽󁢌􋽡󕉼򈮫򀔎񓌥󘯞󽲆𫂮󩡒􋥠񝼇򘿩򢍈񝱣󘋒񲟬󽛤񘒣򡂧󦝄󢢽󤸱󼔋񔬰咷􈤉񶁤􋯯𸁻󊋊󁑐򡢚􁬈񚿋􉷄󖶹󞸭ﳢ򐾚󏬐𱤄񫸶񠎟󫋵򝏋򽨇񃯘񁥧󔅾󇜑򎄐󰡒󜋒󄉱򬽷􊡻򣿃񦮱񋠶򗫾􏄰󠄣񷽍񱔾񛷴󢹃􎃌񩙃񜩐񄬨񪏀𗦁񱅪󢛑򉆅򞷇󹦫񫎏񸇧򑼅𽳼辟僤𳥰򰶼񯓆𿕨􋐣𐠑񅪈򌠬󡓨󸺢򶔒򰷖򬓢򠽔𞚐񖊥󰽖񹝐󆋬򠍤𕳮񝇽򃑐򅀇𩉡󳻕𛾉򈏲󁋯󏣇񙛿􃶗󏑆򲔊򑞧򥨢𑈀𪶓򖻺񔑍񆊈򣐎󋣛🨰󔯽𩇤𓿊𒮫򅤠󠩻򄨙򁔞񛥗󫎧򹛌񦖹󟇗󖁔򔓕󾒾񍴌񒮳򁗶򦪞񠤞囡񪉎񽟾񮠾򑒁񣊫򤿅󍁰󰈂񪃢󱈧󛫺󻞟𨱳򾑴񽲤򘴤񻧽񐼳򽊙𞽓򬚹􋝬󖧛򰀕󘹆󴇎𑷲𽉅󈽳񎿧󊯘🭲񟀝񙪀􏁭򒿢󥗓񱎷𔭥𳈁󐨬𒙠䡺􊅞񏬷򄃋񊚱󔶤񯐳򢖃򡄕񓱢򲌜𒓨򞁒񣈐񒕥򛺤󮨢󽤈򣍌򟣙󼏙񵆩􉫖봍󰂎򌍟򻴭𡲡𳻋󴿣򰴁񛢅򡥽򷟰򦿛󬾤񆐴򳭎򹿋󤄀󤰣𖖌򓻍󔘛󐚄󝰢񒠞𼏥򽚢􋑨񰫷񧱊񳆲󕦸񫰫򕊾񒎔铈𐭷󗫣􆁀𩠀􀹨򵪀󥯯񲠉񟚺󼡹򇎟黮򘬆򠼇򋝕򌼯󢗃񣪑󭺛򲆅𯝕񷉕𩧞𒫆򆦨򢸴󇳫󿔨𷳜򈈎􋜜򥦳󮜘󡐟󿕈򅯑󚑳󋴌򍎪.󓯞򠈿񵫋񰫉󏿟󔟗򿰲񝓿","url_lease_id":"񕖣󽠘񭂁񨠎񈶍𛪟󄺒񮴅򸾘𸾑򮕖􉩄򠷙񭤡􄹴򞲕򠛮𺷿󋴸􋉺񺂑􇵳򢨨񛰰𐜄𼈤襑􈍥𬸴淘񅘛􉔣특򗖠𵧑񄯗󋔵甐󺫜󲥏򭄸𷆣񕿓򄔵񔫤􆿈򓘾򹠴󾝙񧅻󛨆񃍤񛉟󴳘򠗚򅔋򌺘񂆞󮣎󣗈򋖪󕖕򄅎𲻻񱁃񟥪񺥐񥡭󽧗󛉻򢛡򀈾򏶐󯔏򎃟󠄋󶀿油󯏒򟰾񌡘񓪨򩺉򋷑𾣂𓟺擷󢞂񝟙𿴓𭐶𵇢𓣽񨺻򿋨򝭟🖈񾴸󌎯򖳏󰜔񨇤񗛷𲴦򎹖򪢋򋑥񏽩𞺑򘘼񃕬􄫱긋򇷔򝻗򦋟뼜􁉱󼩕𿢳ⱼ󺖻򙙯󓦍𥺭⎃󩰏󪨩򄵼󯽒ﬡ򢔕񃠱񫯽񁠤󿷜񋉠󁀦𕠊򌋖熨񇥕񾒇񷉉󉤻񼈎򩠊󷤊󂔘񳜋򯆄愉򥋈񖕄񱳵񘆤񷁫𼶳򧺃󨛿򠽬񷓸򠁺𱦎񅖗񳑌돡򩢜񮯠먏𣭢󧜔򍦴񝛲󹄹󺠹񅮆ꏬ牜𬔜󵻷򎥦򾸞󼑭񠦪򣍭򜢁񇈗󍛖򼯩𷂤񕼯󨒱󋁵򈕝󌙒𢵺殸򲌴􉞍񮏃򗍨𑗽󩹜🹖󻒱𴾽󴚬𶰋󴼑􁶡񐚃𪰰򩐑򋣀񪜵󍟯🪫򵢾񨥩򚏮򐎰񫧦񕗆⩦󿭻𹿩𹗶􈷀𻤊󐟿𼢹񏅀񘴭򲧰򦺲𯒃󣶰񂰭񙜸𘋋󏜽򒭎􋓔񈐖𴥥򓀲񠫔򆿹𳲲񙉄󱫿񂿕𣊧򖄡𢂭󂹆񷒹󴮃𭋇󂨪󱲭򵆃򬹷𱩢󆿺휟󽁈񜏑򽮙񢞉󚷹󈟢𝞊򠧦񪡿𽻇⚯󣧣𘬕񥆁񢔔󲺢􋄴򷌉𪛺᭾🝖󸋊󠛃𴃣𩂲뛴򾂅􇛁𪡉򰌆񭬄𿜆򕎯򖀡ञ󂎛𿫈􎐞𴗨󛩯񶜿󑆺୦責󤋁ʭ񌮶񳶡򡹤񧒽𚠱𫈺񒢇񘉧򥊁󻑺񀔕𩞛򱴻񚞘𩋂򷛇򥷓񦛷󱓔󰽨򡖷󖉏󔃍󕻌𷨦򀬓򰐸󪱸🠇󃌪󐪵􌭞򓐯𠤅󛴁򱼑򱫓􊕁􈇗𾽷󝲺򼷗󈢞𡽢񟯚𑹨󖏷𮖽񻭓󦸕𗗎󯧺󕧍󨇹򻘫𴍇⡢󽎫􊚀򉴥󿵷󤙗󼘭񗨹󘯇󅡂򈢄臱򖿗򉋭򛑱󂢱󄛿򳒿棤𑗵󋨘񫛼񃒄򔹠𪳟󘛪񎥤򉙹󛽄󊩊󤈿񋄩𔴈𞩛痓򽜴𬷰򥺝ڻ󈎲񕉁󃯂𜢖􀐟򷧠󠓼𞌒󛳜򮅗㙤"}' -H 'X-Vault-Token: ${VAULT_TOKEN}' ${VAULT_ADDR}/v1/sys/leases/renew
  # < HTTP/2 403
  # # // ...
  # {"errors":["permission denied"]}

Thank you once more @matusf.