Enrolling to a CA that returns an empty response crashes the node process
Medium
H
Hyperledger
Submitted None
Actions:
Reported by
mttrbrts
Vulnerability Details
Technical details and impact analysis
If a CA server responds with an empty response during enrollment, an exception is thrown in the event emitter on `end`. This is an uncaughtException and causes the containing node process to exit.
# To replicate:
With the attached files, run:
```
npm install
node badCa.js &
node index.js
```
This starts a simple malicious CA server that provides a response that triggers the exception. The `index.js` script tries 2 different scenarios:
- 1. With a known bad URL, which throws an exception which can be caught by the client application
- 2. With a malicious CA, which throws an exception which cannot be caught by the client application because of the EventEmitted behaviour in node.
> From https://nodejs.org/api/events.html#events_error_events
> If an EventEmitter does not have at least one listener registered for the 'error' event, and an 'error' event is emitted, the error is thrown, a stack trace is printed, and the Node.js process exits.
# Fix
Replace https://github.com/hyperledger/fabric-sdk-node/blob/c10865cfb20d063fdef4c7d96c25c1581f309e84/fabric-ca-client/lib/FabricCAClient.js#L457
`util.format('Enrollment failed with HTTP status code', JSON.parse(data).statusCode)));`
with
`util.format('Enrollment failed with HTTP status code', response.statusCode)));`
The same issue is present at https://github.com/hyperledger/fabric-sdk-node/blob/0d24cec10f7a3e0153fcf3f0158a89c5eaa0cfab/fabric-ca-client/lib/FabricCAClient.js#L318
## Impact
This attack allows an attacker to cause any node client application using the fabric-ca-node SDK to exit. In scenarios where the SDK is used in a server-side application, this will have the effect of denying the use of that server to other users.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$500.00
Submitted
Weakness
Uncontrolled Resource Consumption