OpenAI 披露 Brotli 压缩库远程代码执行漏洞

在这次红队演练中，我们还发现了一个漏洞，它允许在 Brotli 中实现未经身份验证的远程代码执行。Brotli 是一个被广泛部署的压缩库，包含在许多软件中，例如 Node.js、Bun 和 Envoy。 该漏洞可能让攻击者通过发送或回复恶意压缩数据，在受影响系统上运行自己的代码，而无需创建任何用户账户。也就是说，一个接受压缩输入的未修补服务器可能被恶意客户端接管，而一个接受压缩输入（例如“curl --compressed”）的未修补客户端可能被恶意服务器接管。 这个根因问题实际上已于 2 月在 Brotli 源代码中修复，但当时并不知道它会引发安全漏洞，而且此后 Brotli 也没有再发布新版本。由于 Brotli 被内置到其他软件中，任何包含该库的软件也需要采用这一更新，随后该软件的用户也需要跟进。我们向 Brotli 以及 Node.js 等其他下游项目披露了该漏洞，Node.js 已发布或正在发布安全更新，Brotli 也发布了新的版本并公开了 CVE。 有关补丁和缓解措施的更多细节如下： https://t.co/Y1Y72aHxrW

查看原文

During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server. This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE. More details on the patch and mitigations below: https://t.co/Y1Y72aHxrW