Rack: Multipart parsing allows DoS via unbounded scan buffer growth

Summary

Rack::Multipart::Parser reads the request body in chunks of rack.multipart.buffer_size (1 MiB by default) into an internal scan buffer. Parsed bytes are only discarded from that buffer when a chunk ends inside a part body. A request whose parts are sized so that every chunk ends inside, or immediately after, a part's headers is never compacted, so the buffer grows to the size of the request.

This results in a denial of service condition through memory exhaustion for applications that parse multipart requests.

Details

The parser appends each chunk read from the input to a StringScanner and advances through boundaries, headers, and bodies. In the body state, when no closing boundary is found, the consumed prefix is removed before more data is read. In the header state, and in the body state when no body bytes have been consumed yet, the parser requests more data without removing anything. Bytes skipped between parts are not counted against any limit.

An attacker can therefore construct parts that each fit within one chunk and align the chunk boundaries with the part headers. The existing limits on buffered non-file field data, header size, and preamble size do not apply, because each individual part remains small. With default limits the buffer can reach roughly 4 GiB (4096 parts of about 1 MiB). Ordinary file uploads aligned the same way are bounded by the file part limit at roughly 128 MiB per request.

Impact

Any application that parses multipart requests with Rack is affected in its default configuration. An unauthenticated attacker can cause a single request to hold memory proportional to its size for the duration of parsing, exhausting worker memory. The attack requires only a well-formed multipart body.

Mitigation

• Update to a patched version of Rack in which the parser discards parsed bytes from its scan buffer before reading more data.
• Limit the request body size at a reverse proxy or application boundary.
• Set RACK_MULTIPART_PARSER_BYTESIZE_LIMIT to the largest multipart body the application needs to accept, which bounds the memory a single request can hold.