Description

When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STORE permission for a product can call that product's storeAnalysisStatistics Thrift-over-HTTP method. CodeChecker 6.29.0 decodes the attacker-controlled Base64 string and passes the complete compressed input to one-shot zlib.decompress(). No maximum decompressed size is enforced. This gives a correctly authorized, non-superuser store account a high-ratio memory and persistent-disk amplification primitive. The complete output is first materialized as a Python bytes object and is then written to the configured statistics directory. A sufficiently scaled payload can exhaust the API worker or host memory and impair CodeChecker availability. The shipped value of store.analysis_statistics_dir is null, so the affected feature is disabled by default. The primary assessment does not rely on authentication being disabled. There is no authorization bypass and no path traversal in this report.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-11-06T11:17:17.190Z",
  "pubdate": "2026-11-06T11:17:17.190Z",
  "executiveSummary": "A resource exhaustion vulnerability exists in CodeChecker 6.29.0 within the storeAnalysisStatistics Thrift-over-HTTP method. The vulnerability arises from the failure to implement decompression size limits when processing user-supplied compressed data.\nBy submitting a specially crafted, high-ratio compressed Base64 payload, an authenticated attacker with PRODUCT_STORE permissions can trigger uncontrolled memory allocation during the zlib.decompress() operation.\nThis behavior facilitates a denial-of-service (DoS) condition by exhausting the memory (RAM) or disk storage of the host running the CodeChecker API worker. While the feature is disabled by default (store.analysis_statistics_dir is null), deployments that have explicitly enabled this directory for analysis statistics are susceptible to this amplification attack.\nThe vulnerability does not bypass existing authorization controls, but leverages legitimate access to induce system instability. Successful exploitation results in the impairment of service availability, potentially rendering the CodeChecker instance unresponsive.",
  "technicalDetails": "The vulnerability is located in the processing logic for the storeAnalysisStatistics Thrift-over-HTTP method in CodeChecker 6.29.0. When the configuration parameter 'store.analysis_statistics_dir' is enabled, the application accepts Base64-encoded strings provided by authenticated users with 'PRODUCT_STORE' permissions.\nThe root cause is an improper handling of compressed data streams passed to the Python 'zlib.decompress()' function. The application logic decodes the user-provided Base64 input and immediately passes the resulting compressed bytes to the decompressor without establishing a maximum threshold for the decompressed output size.\nThis creates a high-ratio memory and persistent-disk amplification primitive, commonly referred to as a 'decompression bomb' or 'zip bomb' attack. Because the system materializes the full decompressed output as a Python bytes object in memory before writing it to the 'store.analysis_statistics_dir' directory, the memory footprint scales linearly with the decompressed size of the payload, rather than the size of the compressed input.\nThe attack flow is as follows: 1. An attacker identifies a CodeChecker instance where 'store.analysis_statistics_dir' is enabled. 2. The attacker authenticates as a user with 'PRODUCT_STORE' permissions for a target product. 3. The attacker crafts a high-compression-ratio payload designed to expand into a significantly larger size upon decompression. 4. The attacker sends this payload to the 'storeAnalysisStatistics' endpoint via Thrift-over-HTTP. 5. The application decodes the Base64 input and executes 'zlib.decompress()'. 6. The process consumes excessive memory to materialize the decompressed bytes, leading to an 'Out of Memory' (OOM) error or significant swapping, and subsequently writes the oversized content to the statistics directory, which can exhaust disk I/O and storage capacity.\nThis vulnerability is particularly impactful because it requires no path traversal or authorization bypass, relying instead on legitimate but malicious use of an authorized feature. The impact is a severe denial of service affecting both the specific API worker process and, potentially, the availability of the host operating system if memory limits are not strictly enforced via cgroups or similar containerization primitives."
}