CVE-2020-15694
📋 TL;DR
This vulnerability in Nim's standard library httpClient allows malicious servers to provide negative Content-Length values, which the client fails to validate properly. This can lead to memory corruption, denial of service, or potentially arbitrary code execution. Applications using Nim's httpClient to fetch data from untrusted sources are affected.
💻 Affected Systems
- Nim programming language standard library
📦 What is this software?
Nim by Nim Lang
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through memory corruption when processing malformed server responses, potentially allowing full system compromise.
Likely Case
Denial of service through application crashes or resource exhaustion when processing invalid Content-Length values.
If Mitigated
Application instability or crashes without privilege escalation if proper sandboxing and input validation are in place.
🎯 Exploit Status
Exploitation requires controlling the server response or intercepting client-server communication. Public proof-of-concept demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Nim 1.2.6 and later
Vendor Advisory: https://nim-lang.org/blog/2020/07/30/versions-126-and-108-released.html
Restart Required: No
Instructions:
1. Update Nim to version 1.2.6 or later. 2. Recompile all applications using the httpClient module. 3. Redeploy updated applications.
🔧 Temporary Workarounds
Input validation wrapper
allAdd custom validation for Content-Length values before processing
# In Nim code, add validation:
let contentLen = client.get().contentLength()
if contentLen < 0:
raise newException(ValueError, "Invalid Content-Length")
Use alternative HTTP library
allReplace httpClient with a third-party HTTP library that properly validates responses
# Add alternative HTTP library via Nimble:
nimble install httpbeast
🧯 If You Can't Patch
- Implement network segmentation to restrict httpClient access to trusted servers only
- Deploy web application firewalls to inspect and block malicious server responses
🔍 How to Verify
Check if Vulnerable:
Check if application uses Nim's httpClient module and runs on Nim <=1.2.4Check Version:
nim --versionVerify Fix Applied:
Verify Nim version is >=1.2.6 and test with negative Content-Length responses📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unusual Content-Length values in HTTP logs
Network Indicators:
- HTTP responses with negative Content-Length headers
- Unusual traffic patterns to/from Nim applications
SIEM Query:
source="http_logs" AND content_length < 0🔗 References
- http://www.openwall.com/lists/oss-security/2021/02/04/2
- https://consensys.net/diligence/vulnerabilities/nim-httpclient-header-crlf-injection/
- https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/httpclient.nim#L241
- https://nim-lang.org/blog/2020/07/30/versions-126-and-108-released.html
- http://www.openwall.com/lists/oss-security/2021/02/04/2
- https://consensys.net/diligence/vulnerabilities/nim-httpclient-header-crlf-injection/
- https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/httpclient.nim#L241
- https://nim-lang.org/blog/2020/07/30/versions-126-and-108-released.html
