my colleagues Alexis and Brad at Trail of Bits (npub1rcs…7sw8) put together a great post on a basic security mistake that we keep making: attacker-controlled recursion. my favorite thing about these is that they're (1) trivial to find and (2) *way* more impactful than normal DoS spam.
the post contains some great examples of these, including real vulnerabilities in Protobuf and ElasticSearch:
https://blog.trailofbits.com/2025/02/21/dont-recurse-on-untrusted-input/
they'll also be presenting their findings at DistrictCon (npub14f6…c7y5) tomorrow!
https://www.districtcon.org/bios-and-talks-2025/low-effort-dos-with-recursion
yossarian
npub1cg…95g53
2025-02-21 18:44:10 UTC
Author Public Key
npub1cgn080uwn73neyld4lnq878uw6t42aelpkmgtu8xzax2j6lhcxqss95g53Seen on
wss://relay.momostr.pinkPublished at
2025-02-21 18:44:10 UTCEvent JSON
{
"id": "63a7d4637bc9c1a27d603fa22669ac58dea24fed9edfa27b317a636fe87fd2bd",
"pubkey": "c226f3bf8e9fa33c93edafe603f8fc769755773f0db685f0e6174ca96bf7c181",
"created_at": 1740163450,
"kind": 1,
"tags": [
[
"p",
"aa753dedb1ff4e4342cdf2cf221e7b3b8880ffba6703bb68cd203188843e46a1"
],
[
"proxy",
"https://infosec.exchange/@yossarian/114043351879146580",
"web"
],
[
"p",
"1e219624404cb46159e3ec93d4ae1305535765c46a48669795d4b17ac0cbee9e"
],
[
"proxy",
"https://infosec.exchange/users/yossarian/statuses/114043351879146580",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/yossarian/statuses/114043351879146580",
"pink.momostr"
],
[
"-"
]
],
"content": "my colleagues Alexis and Brad at nostr:npub1rcsevfzqfj6xzk0rajfaftsnq4f4wewydfyxd9u46jch4sxta60qjz7sw8 put together a great post on a basic security mistake that we keep making: attacker-controlled recursion. my favorite thing about these is that they're (1) trivial to find and (2) *way* more impactful than normal DoS spam.\n\nthe post contains some great examples of these, including real vulnerabilities in Protobuf and ElasticSearch: \n\nhttps://blog.trailofbits.com/2025/02/21/dont-recurse-on-untrusted-input/\n\nthey'll also be presenting their findings at nostr:npub14f6nmmd3la8yxskd7t8jy8nm8wygpla6vupmk6xdyqcc3pp7g6ss5qc7y5 tomorrow!\n\nhttps://www.districtcon.org/bios-and-talks-2025/low-effort-dos-with-recursion",
"sig": "258bf898366a1f9ba332065e55b34aeff598ba26d5585bfcb6314eea663c3299934cff4d5a134fd1feca44f370033e2af3eb110299cdf23e9690d989e4a06721"
}