A bug in the Brotli compression library, used across many websites and apps, could let attackers crash systems or run malicious code, with proof-of-concept exploit code and real-world attack attempts already reported.
A vulnerability has been found in Brotli, a compression tool developed by Google that many websites use to shrink data before sending it to your browser, according to the Center for Internet Security (CIS). The flaw could let an attacker send a specially crafted piece of compressed data to trick a vulnerable system into writing information outside its intended memory space, a type of bug known as an out-of-bounds write.
If exploited, this could let an outside attacker crash affected systems, steal sensitive information stored in memory, or in the worst case, remotely run their own malicious code on the server, according to CIS. No login or special access is needed to attempt the attack, and it can happen on any server or application that processes Brotli-compressed data from an untrusted source, such as a web request.
This issue affects a long list of widely used technologies, including Node.js, Bun, Envoy Proxy, Istio, Python’s Brotli library, Java’s brotli4j, and Microsoft .NET applications that use Brotli decompression, according to CIS. Several older, no-longer-supported versions of Node.js will not receive a fix at all.
Initially, CIS found no evidence the flaw was being actively exploited, only that demonstration code showing how the attack works had been published. On October 27, CIS updated its advisory to note that exploitation attempts have since been reported by outside researchers.
This mainly affects businesses and organizations that run web servers or applications, rather than everyday home internet users, according to CIS. Large and medium-sized government and business organizations face a high risk, while small organizations face a medium risk.
CIS recommends that organizations identify any systems running affected software and apply the available updates immediately after testing. Until patches can be installed, CIS advises restricting or disabling Brotli decompression of data from untrusted sources as a temporary safeguard.
Based on a release from Center for Internet Security.