DOS by Atom exhaustion is possible by calling oidcc_provider_configuration_worker:get_provider_configuration/1 or oidcc_provider_configuration_worker:get_jwks/1.
Since the name is usually provided as a static value in the application using oidcc, this is unlikely to be exploited.
Example to illustrate the vulnerability.
{ok, Claims} =
oidcc:retrieve_userinfo(
Token,
myapp_oidcc_config_provider,
<<"client_id">>,
<<"client_secret">>,
#{}
)
The vulnerability is present in oidcc_provider_configuration_worker:get_ets_table_name/1.
The function get_ets_table_name is calling erlang:list_to_atom/1.
https://github.com/erlef/oidcc/blob/018dbb53dd752cb1e331637d8e0e6a489ba1fae9/src/oidcc_provider_configuration_worker.erl#L385-L388
There might be a case (Very highly improbable) where the 2nd argument of
oidcc_provider_configuration_worker:get_*/1 is called with a different atom each time which eventually leads to
the atom table filling up and the node crashing.
Patched in 3.0.2, 3.1.2 & 3.2.0-beta.3
Make sure only valid provider configuration worker names are passed to the functions.
3.0.23.1.23.2.0-beta.3Exploitability
AV:LAC:HPR:HUI:NScope
S:CImpact
C:NI:NA:HCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H