An unauthenticated remote denial of service vulnerability exists in OpenZiti zrok versions prior to 2.0.1, which can be triggered by sending malicious requests to OAuth-protected proxy shares.

The vulnerability resides in the endpoints.GetSessionCookie function, where an attacker-supplied cookie chunk count is used to allocate memory without bounds checking. This allows an unauthenticated remote attacker to cause process-level out of memory (OOM) termination or service panics through excessive resource consumption.

Successful exploitation of this vulnerability results in a denial of service for the affected zrok proxy instances. Given the CVSS score of 7.5 (High), this represents a significant risk to availability, as an attacker can repeatedly crash the service with minimal effort. This disruption can lead to operational downtime for any web services or network resources relying on the zrok infrastructure.

Immediate Action: Upgrade all instances of zrok to version 2.0.1 or later to implement the necessary bounds checking and prevent uncontrolled memory allocation.

Proactive Monitoring: Monitor system logs for repeated goroutine panics or sudden spikes in memory usage that could indicate an ongoing attempt to trigger an out of memory event.

Compensating Controls: Deploy a Web Application Firewall (WAF) or ingress controller to filter requests containing malformed or suspicious cookie headers before they reach the zrok proxy.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability, combined with the ease of exploitation, necessitates an immediate update to version 2.0.1. Organizations utilizing zrok for service sharing should prioritize this patch to ensure continued service availability and to mitigate the risk of remote denial of service attacks.