CVE-2020-13949

Q: What is the severity of CVE-2020-13949?

CVE-2020-13949 has a CVSS score of 7.5 (HIGH). This vulnerability in Apache Thrift allows malicious RPC clients to send specially crafted short messages that trigger excessive memory allocation, potentially causing denial of service. It affects Apache Thrift versions 0.9.3 through 0.13.0. Any system running vulnerable Thrift services that accept untrusted client connections is at risk.

7.5 HIGH

Denial of Service

📋 TL;DR

This vulnerability in Apache Thrift allows malicious RPC clients to send specially crafted short messages that trigger excessive memory allocation, potentially causing denial of service. It affects Apache Thrift versions 0.9.3 through 0.13.0. Any system running vulnerable Thrift services that accept untrusted client connections is at risk.

💻 Affected Systems

Products:

Apache Thrift

Versions: 0.9.3 to 0.13.0

Operating Systems: All operating systems running Apache Thrift

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects Thrift services that accept RPC client connections. Services not using Thrift or not exposed to untrusted clients are not vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service unavailability due to memory exhaustion, potentially affecting multiple services if Thrift is used as an RPC framework in distributed systems.

🟠

Likely Case

Service degradation or temporary unavailability for affected Thrift services, requiring restart to recover memory.

🟢

If Mitigated

Minimal impact with proper input validation and memory limits in place, though services may still experience performance degradation.

🌐 Internet-Facing: HIGH - Internet-facing Thrift services are directly exposed to potential exploitation from untrusted sources.

🏢 Internal Only: MEDIUM - Internal services could still be exploited by compromised internal clients or malicious insiders.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted RPC messages to vulnerable Thrift services. No authentication is required if services are exposed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Apache Thrift 0.14.0 and later

Vendor Advisory: https://lists.apache.org/thread.html/r01b34416677f1ba869525e1b891ac66fa6f88c024ee4d7cdea6b456b%40%3Cissues.hbase.apache.org%3E

Restart Required: Yes

Instructions:

1. Upgrade Apache Thrift to version 0.14.0 or later. 2. Recompile and redeploy any applications using Thrift. 3. Restart all Thrift services.

🔧 Temporary Workarounds

Implement message size limits

all

Configure Thrift services to reject messages above a reasonable size threshold

Configure max_message_size in Thrift server configuration

Network segmentation

linux

Restrict access to Thrift services to trusted networks only

iptables -A INPUT -p tcp --dport [thrift_port] -s [trusted_network] -j ACCEPT
iptables -A INPUT -p tcp --dport [thrift_port] -j DROP

🧯 If You Can't Patch

Implement strict network access controls to limit Thrift service exposure
Deploy rate limiting and monitoring for abnormal memory usage patterns

🔍 How to Verify

Check if Vulnerable:

Check Apache Thrift version: thrift --version. If version is between 0.9.3 and 0.13.0 inclusive, the system is vulnerable.

Check Version:

thrift --version

Verify Fix Applied:

Verify thrift --version returns 0.14.0 or higher. Test service functionality with normal RPC traffic.

📡 Detection & Monitoring

Log Indicators:

Unusually large memory allocation messages in Thrift logs
Service restart events following memory exhaustion
Abnormally large RPC message size logs

Network Indicators:

Small incoming packets followed by large memory allocation on server
Repeated connection attempts with small payloads to Thrift ports

SIEM Query:

source="thrift.log" AND ("memory allocation" OR "out of memory" OR "OOM")

📊 Metadata

CVE ID: CVE-2020-13949

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-400

Published: February 12, 2021

Last Updated: November 21, 2024