Zrok Unauthenticated Denial-of-Service Vulnerability via Unbounded Memory Allocation

A denial-of-service vulnerability has been identified in Zrok versions prior to 2.0.1. The issue arises in the 'endpoints.GetSessionCookie' function, which processes an attacker-supplied cookie chunk count. This function is called on every request to an OAuth-protected proxy share, without any prior token validation. As a result, an unauthenticated remote attacker can induce massive heap allocations, leading to out-of-memory process termination or repeated goroutine panics. The vulnerability affects both 'publicProxy' and 'dynamicProxy'.

Impact

Exploitation of this vulnerability causes the proxy process to terminate due to excessive memory usage, disrupting service for all users and shares managed by the proxy.

Remediation

Users can upgrade to Zrok version 2.0.1 to address this vulnerability.