OpenAI discloses remote code execution vulnerability in Brotli compression library
OpenAI discovered during a red team exercise that the Brotli compression library has a vulnerability allowing unauthenticated remote code execution; an attacker can run code on affected systems by sending or replying with malicious compressed data. The root-cause issue was fixed in the Brotli source code in February, but at the time it was not known to constitute a security vulnerability and no new version has been released since; OpenAI has disclosed it to Brotli and downstream projects such as Node.js, and Brotli has released a new version and published a CVE. Greg Brockman said this also illustrates the complexity of patch coordination, because the library is integrated into a large amount of downstream software.
Why read this
SelectedAI score 68
OpenAI discloses an unauthenticated remote code execution vulnerability in the Brotli compression library, illustrating why patch coordination involves a large number of downstream software projects.
Topics
View original postDuring this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server. This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE. More details on the patch and mitigations below: https://t.co/Y1Y72aHxrW
View original
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server. This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE. More details on the patch and mitigations below: https://t.co/Y1Y72aHxrW
Body
we've found and have been working on disclosure for a remote code execution in a widely-deployed compression library.
it's both an impactful issue and an example that shows how complicated it can be to coordinate patching, since it's integrated into a lot of downstream software: