CVE-2022-21700: Memory leak in micronaut-core

Background

The micronaut-core package is a core component of the Micronaut framework, which is a modern, JVM-based, full-stack framework for building modular, easily testable microservice and serverless applications. It provides features such as dependency injection, AOP, and declarative HTTP clients and servers. The package io.micronaut:micronaut-http is specifically responsible for handling HTTP-related functionality.

Vulnerability Detail

This vulnerability (CVE-2022-21700) in micronaut-core allows an attacker to cause a memory leak by sending an invalid Content Type header. The issue arises from the incorrect usage of DefaultArgumentConversionContext in static state. When an invalid Content Type header is received, the memory leak occurs in DefaultArgumentConversionContext. This vulnerability can potentially lead to resource exhaustion and denial of service (DoS) attacks.

Workaround

If updating the package is not immediately feasible, a workaround can be implemented by replacing the default content type binder in an existing Micronaut application. The following code snippet demonstrates how to create a custom FixedRequestBinderRegistry class that replaces the default binder:

package example;

import java.util.List;
import io.micronaut.context.annotation.Replaces;
import io.micronaut.core.convert.ConversionService;
import io.micronaut.http.MediaType;
import io.micronaut.http.bind.DefaultRequestBinderRegistry;
import io.micronaut.http.bind.binders.RequestArgumentBinder;
import jakarta.inject.Singleton;

@Singleton
@Replaces(DefaultRequestBinderRegistry.class)
class FixedRequestBinderRegistry extends DefaultRequestBinderRegistry {

    public FixedRequestBinderRegistry(ConversionService conversionService,
                                      List<RequestArgumentBinder> binders) {
        super(conversionService, binders);
    }

    @Override
    protected void registerDefaultConverters(ConversionService<?> conversionService) {
        super.registerDefaultConverters(conversionService);
        conversionService.addConverter(CharSequence.class, MediaType.class, charSequence -> {
            try {
                return MediaType.of(charSequence);
            } catch (IllegalArgumentException e) {
                return null;
            }
        });
    }
}

This workaround replaces the default content type binder and handles the conversion of the CharSequence to MediaType in a way that prevents the memory leak.

Conclusion

The vulnerability (CVE-2022-21700) in micronaut-core allows for a memory leak when an invalid Content Type header is received. It is crucial to update the micronaut-http package to version 3.2.7 or above to mitigate this vulnerability. If immediate package update is not possible, a workaround can be implemented by replacing the default content type binder. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for io.micronaut:micronaut-http →

FAQ