OpenSIPS up to 3.1.7/3.2.4 parse_mi_request memory leak

Summaryinfo

A vulnerability described as problematic has been identified in OpenSIPS up to 3.1.7/3.2.4. This issue affects the function parse_mi_request. Such manipulation leads to memory leak. This vulnerability is uniquely identified as CVE-2023-28096. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in OpenSIPS up to 3.1.7/3.2.4. It has been rated as critical. Affected by this issue is the function parse_mi_request. The manipulation with an unknown input leads to a memory leak vulnerability. Using CWE to declare the problem leads to CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. Impacted is availability. CVE summarizes:

OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function `parse_mi_request` while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form `{"jsonrpc": "2.0","method": "log_le`. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time. To abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted interfaces. In cases where the MI is exposed to the internet without authentication, abuse of this issue will lead to memory exhaustion which may affect the underlying system’s availability. No authentication is typically required to reproduce this issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing JSON objects. The issue has been fixed in versions 3.1.8 and 3.2.5.

The weakness was disclosed 03/16/2023 as GHSA-2mg2-g46r-j4qr. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-28096 since 03/10/2023. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 2.0, 2.3, 3.1.8 or 3.2.5 eliminates this vulnerability. Applying the patch 417568707520af25ec5c5dd91da18e6db3649dcb is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• OpenSIPS

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.1.7
• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4

License

• open-source

Website

• Product: https://github.com/OpenSIPS/opensips/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion