Executive brief
The Apache OpenWhisk JavaScript client library is used by developers to invoke serverless functions. When a numeric value is passed as the API key parameter, the library allocates an uninitialized memory buffer and sends it over the network in an HTTP Authorization header (base64-encoded). An attacker who can observe network traffic or control the API endpoint can extract sensitive data from server memory that was left in the buffer.
Technical details
This vulnerability exists in the openwhisk npm package before version 3.3.1 and is caused by improper use of the deprecated Node.js Buffer constructor. When a numeric value is supplied as the api_key parameter, the code uses `new Buffer(n)` which allocates an uninitialized buffer of size n bytes rather than converting the input to a string. This uninitialized buffer—containing remnants of previously freed memory—is then base64-encoded and transmitted in the Authorization HTTP header to the OpenWhisk API endpoint. The vulnerability requires the attacker to either control the api_key input or be in a position to observe network traffic. The fix, merged in PR#34, replaces the deprecated `new Buffer()` constructor with `Buffer.from()`, which safely converts input to a string representation. Affected versions prior to 3.3.1 should be updated immediately.
Affected products
- Apache openwhisk before 3.3.1
Timeline
- 2020-09-01: disclosed
- 2020-03-02: patched: Fix merged in PR#34; version 3.3.1 released