You can deploy this model and start earning money today!

hacnho/
protobuf-authentication-providers-dos-poc

Views

No views yet

Protocol Buffers Authentication providers materialization DoS PoC

This repository contains a benign security research PoC for a protobuf binary artifact that drives large repeated-message materialization during google.api.auth_pb2.Authentication.ParseFromString(...).

Files:

control_one_rule.pb
malicious_providers_5000000.pb
reproduce.py

Observed behavior:

control artifact:
- parses successfully with zero providers entries
malicious artifact:
- both files are 10,000,000 bytes
- parses successfully with 5,000,000 providers entries
- increases peak RSS by about 565144 kB in local clean-process replay
- takes about 22.98x the control parse time

Tested runtime:

protobuf==7.35.1
Python: /usr/bin/python3

Public files:

https://huggingface.co/hacnho/protobuf-authentication-providers-dos-poc/resolve/main/control_one_rule.pb
https://huggingface.co/hacnho/protobuf-authentication-providers-dos-poc/resolve/main/malicious_providers_5000000.pb
https://huggingface.co/hacnho/protobuf-authentication-providers-dos-poc/resolve/main/reproduce.py

Reproduction:

python3 reproduce.py

hacnho/protobuf-authentication-providers-dos-poc

Protocol Buffers Authentication providers materialization DoS PoC

hacnho/
protobuf-authentication-providers-dos-poc