Miggo Logo
Miggo Vulnerability Database
→
GHSA-rmqv-7v3j-mr7p

GHSA-rmqv-7v3j-mr7p: Duplicate Advisory: Scrapy decompression bomb vulnerability

7.5

CVSS Score
3.0

Basic Information

CVE ID
-
GHSA ID
GHSA-rmqv-7v3j-mr7p
EPSS Score
-
CWE
CWE-409
Published
4/16/2024
Updated
4/16/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
scrapypip< 2.11.12.11.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper handling of decompressed data size limits. The key evidence is:

  1. The CWE-409 (Data Amplification) classification and advisory description about decompression bombs
  2. Commit changes adding DOWNLOAD_MAXSIZE/DOWNLOAD_WARNSIZE checks during decompression
  3. Removal of bulk decompression in httpcompression.py and replacement with chunked decompression in _compression.py
  4. Test cases added for 'bomb' payloads across multiple compression formats

The original _decode() and gunzip() functions lacked incremental size tracking, allowing small compressed inputs to decompress to massive outputs. The patch introduced chunked decompression with size monitoring in _inflate/_unbrotli/_unzstd helpers, confirming the vulnerability existed in these functions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

## *upli**t* **visory T*is **visory **s ***n wit**r*wn ****us* it is * *upli**t* o* **S*-*j*m-v*m*-jqm*. T*is link is m*int*in** to pr*s*rv* *xt*rn*l r***r*n**s. ## Ori*in*l **s*ription T** s*r*py/s*r*py proj**t is vuln*r**l* to XML *xt*rn*l *ntity

Reasoning

T** vuln*r**ility st*ms *rom improp*r **n*lin* o* ***ompr*ss** **t* siz* limits. T** k*y *vi**n** is: *. T** *W*-*** (**t* *mpli*i**tion) *l*ssi*i**tion *n* **visory **s*ription **out ***ompr*ssion *om*s *. *ommit ***n**s ***in* *OWNLO**_M*XSIZ*/*OWN