Skip to content

Latest commit

 

History

History
67 lines (56 loc) · 7.09 KB

threat-modeling.md

File metadata and controls

67 lines (56 loc) · 7.09 KB

Threat Model Analysis for apache/incubator-brpc

Threat: Deserialization of Untrusted Data (RCE)

  • Description: An attacker sends a crafted message containing malicious serialized data. The bRPC server, upon deserializing this data (using a vulnerable Protobuf, JSON, or Thrift parser integrated within bRPC), executes arbitrary code injected by the attacker. This exploits vulnerabilities in bRPC's handling of input messages and its reliance on potentially vulnerable serialization libraries.
    • Impact: Complete system compromise. The attacker gains full control over the server.
    • Affected Component: bRPC Server, specifically the InputMessage handling and the chosen serialization library integration (e.g., protobuf, json2pb, thrift). Vulnerable functions would be those related to parsing and deserialization (e.g., ParseFrom… methods in the Protobuf library as used by bRPC).
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Prefer Protobuf: Use Protocol Buffers as the primary serialization format.
      • Schema Validation: Strictly validate all incoming data against the Protobuf schema before deserialization within the bRPC context. Use generated code.
      • Avoid Custom Deserializers: Do not use custom deserializers or type handling features in JSON or Thrift within bRPC unless absolutely necessary and thoroughly vetted.
      • Update Dependencies: Regularly update bRPC and all serialization libraries (Protobuf, etc.) to the latest versions. This is crucial as bRPC relies on these.
      • Limit Message Size: Enforce strict limits on the maximum size of incoming messages processed by bRPC.
      • Sandboxing (Advanced): Consider sandboxing the bRPC deserialization logic.

Threat: Denial of Service (DoS) via Resource Exhaustion (bRPC-Specific)

  • Description: An attacker exploits bRPC's concurrency model or resource management to cause a denial of service. This could involve sending a flood of requests that exhaust bRPC's thread pool (bthread), sending excessively large messages that consume memory allocated by bRPC, or triggering resource leaks within bRPC's internal components. The key difference from a generic DoS is that this targets bRPC's specific mechanisms.
    • Impact: Service unavailability.
    • Affected Component: bRPC Server, specifically the connection handling (Server::Start), request processing (Service::Process), and bRPC's resource management components (e.g., bthread, memory allocation within bRPC).
    • Risk Severity: High
    • Mitigation Strategies:
      • Connection Limits: Limit concurrent connections managed by bRPC.
      • Request Rate Limiting (bRPC-Level): Implement rate limiting specifically within bRPC's request handling, potentially using custom filters.
      • Message Size Limits (bRPC-Enforced): Enforce strict message size limits within bRPC's message processing.
      • Timeouts (bRPC-Specific): Set appropriate timeouts for all bRPC operations (connection, request processing).
      • bthread Configuration: Carefully configure bthread parameters (stack size, worker threads) to prevent exhaustion within bRPC's threading model.
      • Resource Monitoring (bRPC Metrics): Monitor bRPC's internal resource usage metrics (if available) and set alerts.

Threat: Man-in-the-Middle (MitM) Attack via Service Discovery Compromise (bRPC Client)

  • Description: An attacker compromises the service discovery mechanism used by the bRPC client. The attacker redirects the bRPC client to a malicious server, intercepting and potentially modifying communication. This directly impacts the bRPC client's connection establishment.
    • Impact: Data breach, data modification, service disruption.
    • Affected Component: bRPC Client, specifically the Channel initialization and connection establishment, and the service discovery integration used by the client (e.g., NamingService, LoadBalancer as used by the bRPC client).
    • Risk Severity: High
    • Mitigation Strategies:
      • Secure Service Discovery: Secure the service discovery mechanism itself.
      • Mutual TLS (mTLS): Implement mTLS between bRPC clients and servers. This is the primary defense.
      • Certificate Pinning (Advanced): Pin the server's certificate in the bRPC client.
      • Server Identity Validation: Validate the server's identity (hostname, certificate) within the bRPC client's connection logic.

Threat: Authentication Bypass via Custom bRPC Filter/Interceptor Flaw

  • Description: An attacker exploits a vulnerability in a custom bRPC filter or interceptor that is part of the bRPC server or client and is responsible for authentication. The attacker bypasses authentication checks, gaining unauthorized access. This is a direct threat to the bRPC component.
    • Impact: Unauthorized access to services.
    • Affected Component: Custom Filter or Interceptor implementations within the bRPC Server or bRPC Client.
    • Risk Severity: High
    • Mitigation Strategies:
      • Secure Coding Practices: Follow secure coding practices for the custom filter/interceptor.
      • Code Review: Thoroughly review the custom filter/interceptor code.
      • Input Validation: Validate all input within the filter/interceptor, even if validated elsewhere.
      • Least Privilege: Ensure the filter/interceptor operates with least privilege.
      • Testing: Thoroughly test the custom filter/interceptor, including with malicious inputs.

Threat: Configuration Vulnerability - Weak Authentication within bRPC

  • Description: The bRPC server is configured with weak or default authentication settings specifically within its bRPC configuration, or bRPC-level authentication is disabled. An attacker connects to the bRPC server without valid credentials.
    • Impact: Unauthorized access to the service and its data.
    • Affected Component: bRPC Server configuration (e.g., ServerOptions), specifically settings related to bRPC's built-in authentication mechanisms (e.g., Authenticator).
    • Risk Severity: High
    • Mitigation Strategies:
      • Strong Authentication: Implement strong authentication mechanisms within bRPC (e.g., mTLS, a robust custom Authenticator).
      • No Default Credentials: Never use default credentials for bRPC's authentication.
      • Configuration Management: Use secure configuration management for bRPC settings.
      • Regular Audits: Regularly audit bRPC configurations for security.