Centrifugo Decompression Bomb Denial-of-Service Vulnerability in WebSocket Transport

A denial-of-service vulnerability has been identified in Centrifugo versions prior to 6.8.4. The issue arises in the unidirectional WebSocket transport when compression is enabled. The server improperly handles compressed data, allowing unauthenticated requests to the WebSocket connection endpoint to cause significant memory and CPU strain. This vulnerability exploits the WebSocket 'permessage-deflate' compression, which can inflate a small compressed frame into a large amount of uncompressed data, effectively creating a 'decompression bomb' attack. The problem is rooted in the WebSocket connection's read message handling, where the decompressed data is not subject to any size limit, contrary to the compressed data which is capped.

Impact

Exploitation of this vulnerability leads to a pre-authentication denial-of-service condition, where minimal bandwidth usage can cause large memory allocations and CPU-intensive operations. This degrades the server's availability for all users.

Reproduction

The vulnerability can be reproduced by running Centrifugo with the unidirectional WebSocket transport enabled and compression turned on. An unauthenticated WebSocket connection can then be established to the '/connection/uni_websocket' endpoint. Once the connection is open, a compressed frame that exceeds the default message size limit can be sent. The server will decompress the frame without any restrictions, causing a spike in memory usage and CPU consumption.

Remediation

Users can upgrade to Centrifugo version 6.8.4 or later, where this vulnerability has been fixed.