CVE-2021-21369

Potential DoS in Besu HTTP JSON-RPC API

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requests (incorrect password). As the supplied password is checked for validity on the main vertx event loop and takes a relatively long time this can cause the processing of other valid requests to fail. A valid username is required for this vulnerability to be exposed. This has been fixed in version 1.5.1.

Hyperledger Besu es un cliente Ethereum de código abierto, compatible con MainNet, escrito en Java. En Besu versiones anteriores a 1.5.1 se presenta una vulnerabilidad de denegación de servicio que involucra al servicio HTTP JSON-RPC API . Si la autenticación de nombre de usuario y contraseña está habilitada para el servicio de HTTP JSON-RPC API , antes de realizar cualquier petición a un endpoint de la API, el solicitante debe usar el endpoint de inicio de sesión para obtener un token web JSON (JWT) con sus credenciales. Un solo usuario puede sobrecargar fácilmente el endpoint de inicio de sesión con peticiones no válidas (contraseña incorrecta). Como se comprueba la validez de la contraseña proporcionada en el bucle de eventos principal de vertx y lleva un tiempo relativamente largo, esto puede causar que el procesamiento de otras peticiones válidas presenten un fallo. Es requerido un nombre de usuario válido para que se exponga esta vulnerabilidad. Esto ha sido corregido en la versión 1.5.1

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-12-22 CVE Reserved
2021-03-09 CVE Published
2023-03-08 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-400: Uncontrolled Resource Consumption

CAPEC

References (4)

URL	Tag	Source
https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151	Release Notes
https://github.com/hyperledger/besu/security/advisories/GHSA-qgfj-mjpc-7w3q	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/hyperledger/besu/commit/06e35a58c07a30c0fbdc0aae45a3e8b06b53c022	2021-03-16
https://github.com/hyperledger/besu/pull/1144	2021-03-16

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linuxfoundation Search vendor "Linuxfoundation"		Besu Search vendor "Linuxfoundation" for product "Besu"				< 1.5.1 Search vendor "Linuxfoundation" for product "Besu" and version " < 1.5.1"		-		Affected