Miggo Logo

CVE-2023-32732: gRPC connection termination issue

5.3

CVSS Score
3.1

Basic Information

EPSS Score
0.04362%
Published
7/6/2023
Updated
2/13/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
io.grpc:grpc-protobufmaven< 1.53.01.53.0
grpciopip< 1.53.01.53.0
grpcrubygems< 1.53.01.53.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing null checks in header processing functions. The patch adds Preconditions.checkNotNull() to various toBytes/toStream methods in Metadata's inner classes. These functions process '-bin' suffixed headers and convert values using marshallers. Without null checks, invalid base64 inputs would cause NPEs during header serialization, terminating connections. The vulnerable functions are the original implementations that directly returned marshaller results without validation, as evidenced by the added null checks in the patch. All modified functions handle header value conversion and would appear in stack traces when processing malicious headers.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*RP* *ont*ins * vuln*r**ility w**r**y * *li*nt **n **us* * t*rmin*tion o* *onn**tion **tw**n * *TTP* proxy *n* * *RP* s*rv*r: * **s*** *n*o*in* *rror *or `-*in` su**ix** *****rs will r*sult in * *is*onn**tion *y t** *RP* s*rv*r, *ut is typi**lly *llo

Reasoning

T** vuln*r**ility st*ms *rom missin* null ****ks in *****r pro**ssin* *un*tions. T** p*t** ***s `Pr**on*itions.****kNotNull()` to v*rious `to*yt*s`/`toStr**m` m*t*o*s in `M*t***t*`'s inn*r *l*ss*s. T**s* *un*tions `pro**ss` '-*in' su**ix** *****rs *n