CVE-2024-36612
📋 TL;DR
Zulip versions 8.0 through 8.3 contain a memory leak vulnerability in popover handling that allows attackers to gradually exhaust server memory through repeated triggering. This affects all Zulip server deployments running vulnerable versions, potentially leading to denial of service. The vulnerability requires user interaction to trigger but can be exploited by any authenticated user.
💻 Affected Systems
- Zulip
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server crash and denial of service due to memory exhaustion, requiring server restart and potentially causing data loss or service disruption.
Likely Case
Gradual performance degradation leading to increased latency and potential service instability until memory is reclaimed or server is restarted.
If Mitigated
Minimal impact with proper monitoring and memory limits in place, though some performance degradation may still occur during attack.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple - repeatedly triggering popovers causes memory accumulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.4 and later
Vendor Advisory: https://github.com/zulip/zulip/commit/0a90a13becbf0338a8fc1ad37946e51c2c25b0a5
Restart Required: Yes
Instructions:
1. Backup your Zulip installation and database. 2. Upgrade to Zulip 8.4 or later using standard upgrade procedures. 3. Restart the Zulip server services. 4. Verify the fix by checking version and monitoring memory usage.
🔧 Temporary Workarounds
Disable popover functionality
allTemporarily disable popover features to prevent exploitation while planning upgrade.
Modify web/src/click_handlers.js to comment out popover event handlers
Implement memory limits
linuxConfigure system memory limits and monitoring to detect and mitigate memory exhaustion.
Set memory limits via systemd or container runtime (e.g., systemctl set-property zulip.service MemoryMax=2G)
🧯 If You Can't Patch
- Implement strict memory monitoring and alerting for abnormal memory growth patterns.
- Restrict user permissions to minimize potential attackers and implement rate limiting on UI interactions.
🔍 How to Verify
Check if Vulnerable:
Check Zulip version: /home/zulip/deployments/current/version.py or via web interface admin panel.Check Version:
cat /home/zulip/deployments/current/version.py | grep ZULIP_VERSIONVerify Fix Applied:
Verify version is 8.4+ and monitor memory usage during normal operation for stability.📡 Detection & Monitoring
Log Indicators:
- Rapid memory consumption in system logs
- Out of memory errors in Zulip logs
- Frequent popover-related JavaScript errors
Network Indicators:
- Increased HTTP requests to popover endpoints
- Slowing response times from Zulip server
SIEM Query:
source="zulip.log" AND ("memory" OR "out of memory" OR "OOM") OR source="system.log" AND process="zulip" AND ("memory limit" OR "killed")