http2shell turns a brotli flaw into remote code execution in Node and Python
Evolving Threat: http2shell is an RCE in node, Python, and more
A newly publicized remote code execution bug, dubbed http2shell, affects Node and Python servers through the brotli compression library. Commenters trace it to brotli 1.2.0 and earlier, note that the Python package already ships a 1.2.1 fix, and point out that Google's brotli patch has existed since February. Rust servers appear safe because the brotli crate doesn't bind to the C library. Suggested mitigation: disable br content-encoding on both sides.
OpenAI's tweet says it wasn't recognized as security relevant so wasn't important enough to make a release — until their agent realised it was.
- mirashii
I feel as though this should be googlebrotli2shell, not http2shell. Google deserves to take a bit of a reputational hit for this. This is a basic memory safety violation, from the same organization that does wuffs, that promotes Rust for memory safety, that has Carbon. zstd has high quality rust implementations and is from roughly the same time.
On top of that, the brotli library saw no releases for almost a full year, with the fix for this vulnerability being committed back in February. Google builds from main for all their projects, so were unaffected, but open source releases are a complete afterthought. Over 100 commits with miscellaneous fixes left languishing until a security incident forces a release.
- ataraxia937
This one again feels overblown, at least for servers. I just checked an org of over 200 GitHub repos. Node, Python, and C#. None of them are vulnerable... because none of them actually call the Brotli decoder. It's just not enabled by default on the server side, by the platforms themselves. This is much like the PHP bugs, where specific conditions have to be in play before you're actually vulnerable.
For clients? Sure, that's a bigger risk. Patch them. But bad guys aren't attacking your clients unless the clients connect to them. Don't stay up late to fix this.
(And yes, .NET is included here, because Microsoft's Brotli module is a binding for Google's vulnerable reference implementation.)
- anonymous908213
I could do without every memory bug getting a cute sensational name and marketing push, I have to say.
- rvanlaar
It looks like brotli <= 1.2.0 is vulnerable.
The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/
- hatthew
I feel like normal security issues don't get much publicity. The PHP and eMudhra issues seemed severe, and worth publicity. But then with things like this, I'm not sure. Is this a severe issue? Or is it just a run of the mill issue that's only newsworthy because web security is on people's minds right now?