GHSA-qvxg-wjxc-r4gg Vapor vulnerable to denial of service in URLEncodedFormDecoder

• SwiftURL github.com/vapor/vapor: < 4.61.1 → fixed in 4.61.1

Vapor is an HTTP web framework for Swift. Vapor versions earlier than 4.61.1 are vulnerable to a denial of service in the URLEncodedFormDecoder. Impact When using automatic content decoding, e.g. ```swift app.post("foo") { request -> String in let foo = try request.content.decode(Foo.self) return "\(foo)" } ``` An attacker can craft a request body that can make the server crash with the following request: ``` curl -d "array[_0][0][array][_0][0][array]$(for f in $(seq 1100); do echo -n '[_0][0][array]'; done)[string][_0]=hello%20world" http://localhost:8080/foo ``` The issue is unbounded, attacker controlled stack growth which will at some point lead to a stack overflow. Patches Fixed in 4.61.1 Workarounds If you don't need to decode Form URL Encoded data, you can disable the `ContentConfiguration` so it won't be used. E.g. in configure.swift ```swift var contentConfig = ContentConfiguration() contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .json) contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .json) contentConfig.use(encoder: JSONEncoder.custom(dates: .iso8601), for: .jsonAPI) contentConfig.use(decoder: JSONDecoder.custom(dates: .iso8601), for: .jsonAPI) ContentConfiguration.global = contentConfig ``` For more information If you have any questions or comments about this advisory: • Open an issue in the Vapor repo • Ask in Vapor Discord