CVE-2023-47163
📋 TL;DR
CVE-2023-47163 is a vulnerability in Remarshal that allows unlimited expansion of YAML alias nodes, making it susceptible to Billion Laughs attacks. This can cause denial-of-service by consuming excessive memory and CPU when processing malicious YAML files. Anyone using Remarshal to process untrusted YAML content is affected.
💻 Affected Systems
- Remarshal
📦 What is this software?
Remarshal by Remarshal Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system resource exhaustion leading to service unavailability, potentially affecting dependent applications and requiring system restart.
Likely Case
Denial-of-service condition where Remarshal processes crash or become unresponsive when processing malicious YAML files.
If Mitigated
No impact if only trusted YAML files are processed or if the vulnerability is patched.
🎯 Exploit Status
Billion Laughs attacks are well-known and easy to craft. The vulnerability is in the core YAML parsing logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.17.1
Vendor Advisory: https://github.com/remarshal-project/remarshal/releases/tag/v0.17.1
Restart Required: No
Instructions:
1. Check current Remarshal version. 2. Update to v0.17.1 or later using package manager or direct installation. 3. Verify the update was successful.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict validation of YAML files before processing with Remarshal
Resource limiting
linuxRun Remarshal with resource limits (memory, CPU) to contain potential DoS
ulimit -v 1000000
systemd-run --scope -p MemoryLimit=1G remarshal
🧯 If You Can't Patch
- Avoid processing untrusted YAML files with vulnerable versions of Remarshal
- Implement network segmentation and monitoring for systems running vulnerable versions
🔍 How to Verify
Check if Vulnerable:
Check Remarshal version: if version is less than 0.17.1, it is vulnerableCheck Version:
remarshal --versionVerify Fix Applied:
Verify Remarshal version is 0.17.1 or higher and test with known malicious YAML files📡 Detection & Monitoring
Log Indicators:
- High memory usage spikes
- Process crashes or timeouts
- Repeated YAML parsing failures
Network Indicators:
- Unusually large YAML file uploads
- Multiple failed parsing attempts
SIEM Query:
source="remarshal.log" AND ("memory" OR "crash" OR "timeout")🔗 References
- https://github.com/remarshal-project/remarshal/commit/fd6ac799a02f533c3fc243b49cdd6d21aa7ee494
- https://github.com/remarshal-project/remarshal/releases/tag/v0.17.1
- https://jvn.jp/en/jp/JVN86156389/
- https://github.com/remarshal-project/remarshal/commit/fd6ac799a02f533c3fc243b49cdd6d21aa7ee494
- https://github.com/remarshal-project/remarshal/releases/tag/v0.17.1
- https://jvn.jp/en/jp/JVN86156389/
