CVE-2025-4528: BorutaIdentityWeb Authenticated Atom-Exhaustion DoS Analysis & Fix

Summary of Critical Vulnerability Information Vulnerability Overview Vulnerability Name: Authenticated atom-exhaustion DoS in CVE ID: CVE-2025-4528 Severity: High (CVSS v3.1 score 7.1/10) Vulnerability Type: Authenticated Denial of Service (DoS) Root Cause: The endpoint unconditionally converts every key in the user-submitted request body into an atom via and writes it into the BEAM atom table. An attacker can exhaust the BEAM atom table (default capacity of 1,048,576 atoms) by crafting a large number of random key names (e.g., , etc.), causing the BEAM VM to crash. This renders the entire umbrella service (gateway, admin API, OIDC provider, identity, and gateways) unavailable until the service is restarted. Scope of Impact Affected Versions: and Fixed Version: Affected Components: (OIDC provider), (reverse proxy), (admin API) Trigger Conditions: Any authenticated end-user (registration is open by default), subject to a per-IP rate limit (10 requests/second). However, a single session can exhaust the atom table within 3–5 seconds. Remediation Convert keys from the request body to existing atoms and silently discard unknown keys. This aligns with the documented behavior of and matches the internal implementation of . Fix Code (lines 25–43 of ): Alternative Approach: Restrict fields to an explicit whitelist owned by the User schema, such as , , , , etc. PoC / Exploit Code PoC Runtime Environment: (Erlang/OTP 27, Elixir 1.17) + host networking. PoC Script (based on lines 30–33 of upstream): Execution Results: HTTP Request Example: Rate Limiting Configuration: . A single authenticated session can inject 50,000 atoms per second, exceeding the per-IP limit. Parallel sessions can further widen the attack window.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-4528: BorutaIdentityWeb Authenticated Atom-Exhaustion DoS Analysis & Fix

More from this source