CVE-2021-32918
📋 TL;DR
This vulnerability in Prosody XMPP servers allows remote attackers to cause denial-of-service via memory exhaustion without authentication. It affects Prosody servers running under Lua 5.2 or Lua 5.3 with default configurations. The attack can crash the server by exhausting available memory.
💻 Affected Systems
- Prosody XMPP Server
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Prosody by Prosody
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage with Prosody server crashing due to memory exhaustion, potentially affecting all connected XMPP clients and services.
Likely Case
Service disruption and server crashes requiring manual restart, with potential data loss for in-memory sessions.
If Mitigated
Minimal impact if patched or workarounds applied; otherwise normal operation unaffected.
🎯 Exploit Status
The vulnerability is in default settings and requires no authentication, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.11.9
Vendor Advisory: https://blog.prosody.im/prosody-0.11.9-released/
Restart Required: Yes
Instructions:
1. Backup configuration and data. 2. Stop Prosody service. 3. Update to Prosody 0.11.9 or later via package manager or source. 4. Restart Prosody service. 5. Verify service is running correctly.
🔧 Temporary Workarounds
Memory limit configuration
allConfigure memory limits in Prosody configuration to limit impact
Edit prosody.cfg.lua and add: memory_limit = "512MB"
Network access restrictions
linuxRestrict access to Prosody ports to trusted networks only
Configure firewall rules to limit access to ports 5222, 5269, 5280, 5281
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to Prosody services
- Monitor memory usage closely and implement automated restart scripts for when memory thresholds are exceeded
🔍 How to Verify
Check if Vulnerable:
Check Prosody version and Lua version: prosodyctl about | grep -E 'version|Lua'Check Version:
prosodyctl about | grep 'version'Verify Fix Applied:
Verify version is 0.11.9 or later: prosodyctl about | grep 'version'📡 Detection & Monitoring
Log Indicators:
- High memory usage warnings
- Process crashes
- Out of memory errors in system logs
Network Indicators:
- Unusual high-volume connections to XMPP ports
- Connection patterns suggesting DoS attempts
SIEM Query:
source="prosody.log" AND ("out of memory" OR "memory limit" OR "killed")🔗 References
- http://www.openwall.com/lists/oss-security/2021/05/13/1
- http://www.openwall.com/lists/oss-security/2021/05/14/2
- https://blog.prosody.im/prosody-0.11.9-released/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MFFBZWXKPZEVZNQSVJNCUE7WRF3T7DG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUN63AHEWB2WRROJHU3BVJRWLONCT2B7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWJ2DG2DFJOEFEWOUN26IMYYWGSA2ZEE/
- https://security.gentoo.org/glsa/202105-15
- https://www.debian.org/security/2021/dsa-4916
- http://www.openwall.com/lists/oss-security/2021/05/13/1
- http://www.openwall.com/lists/oss-security/2021/05/14/2
- https://blog.prosody.im/prosody-0.11.9-released/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MFFBZWXKPZEVZNQSVJNCUE7WRF3T7DG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUN63AHEWB2WRROJHU3BVJRWLONCT2B7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWJ2DG2DFJOEFEWOUN26IMYYWGSA2ZEE/
- https://security.gentoo.org/glsa/202105-15
- https://www.debian.org/security/2021/dsa-4916
