OpenAI discovers critical RCE vulnerability in Brotli library
During a penetration test (red team exercise), a team discovered a critical vulnerability in the Brotli compression library. This flaw allows for Remote Code Execution (RCE) without authentication, posing a serious threat to systems using compressed data.
The vulnerability allows an attacker to compromise both the server and the client simply by sending or receiving compressed malicious data. Since Brotli is used in many popular tools, such as Node.js, Bun, and Envoy, the risk of attack is very high.
Although the root of the problem was fixed previously, its security was unknown, and now all developers using this library must urgently update their software. OpenAI reported this issue, and developers have released patches and new versions of Brotli.
Why it matters
- —The vulnerability allows for remote code execution without needing a login (unauthenticated RCE).
- —Brotli is a fundamental library used in many popular software products (Node.js, Bun, Envoy).
- —The discovery requires immediate updating of all dependent systems to prevent exploitation.
Key facts
- The vulnerability allows for Remote Code Execution (RCE) via compressed Brotli data.
- The attack can be carried out on both the server and the client without requiring an account.
- The issue was discovered during a red team exercise.
- To mitigate the risks, developers have released updates for Brotli and all dependent projects.
The full text is in the original source. Here we provide a brief summary and key facts.