Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability has two main components, both of which can lead to a denial of service. First, the default HTTP server implementation in aws-smithy-http-server did not have any timeouts configured. This made it vulnerable to Slowloris-style attacks where a client can hold a connection open for a long time by sending data very slowly. The patch addresses this by adding default timeouts for reading headers and for keeping connections alive. The vulnerable function is aws_smithy_http_server::serve::serve which sets up the server. Second, the server would read the entire request body into memory without any size limit. This could be exploited by a client sending a very large request body, causing the server to run out of memory. The patch introduces a new function collect_body_limited that reads the body with a configurable size limit. This function is now used by the code generated for handling operation inputs, specifically in the from_request implementation of the input structs. The combination of these two issues made the server vulnerable to denial of service.
aws_smithy_http_server::serve::serverust-runtime/aws-smithy-http-server/src/serve/mod.rs
<Operation>Input::from_requestcodegen-server/src/main/kotlin/software/amazon/smithy/rust/codegen/server/smithy/protocols/ServerHttpBoundProtocolGenerator.kt
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aws-smithy-http-server | rust | <= 0.66.4 | 0.66.5 |