PyPI · thumbor
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
Thumbor's filters:convolution(<matrix>, <columns>, <should_normalize>) filter passes the user-controlled <columns> value to a C extension (thumbor/ext/filters/_convolution.c) where it is used as a divisor (for % and /) without validating columns > 0. When columns=0, the C code triggers undefined behavior; on x86_64 this reliably results in a fatal divide-by-zero trap (SIGFPE) and crashes the Thumbor process (confirmed on Linux x86_64 and macOS Intel x86_64), causing a remote denial of service.
The Python filter accepts columns=0, and the native C extension uses columns_count as a divisor without validating it.
columns=0 (thumbor/filters/convolution.py):@filter_method(
r"(?:[-]?[\d]+\.?[\d]*[;])*(?:[-]?[\d]+\.?[\d]*)",
BaseFilter.PositiveNumber, # accepts 0
BaseFilter.Boolean,
)
async def convolution(self, matrix, columns, should_normalize=True):
...
imgdata = _convolution.apply(..., matrix, columns, should_normalize)
BaseFilter.PositiveNumber matches "0" (thumbor/filters/__init__.py):
class BaseFilter:
PositiveNumber = {"regex": r"[\d]+", "parse": int} # matches "0"
PositiveNonZeroNumber = {"regex": r"[\d]*[1-9][\d]*", "parse": int}
columns_count without a zero check (thumbor/ext/filters/_convolution.c):kernel_size = PyTuple_Size(kernel_tuple);
if ((kernel_size % columns_count != 0) ||
(kernel_size % 2 == 0) ||
((kernel_size / columns_count) % 2) == 0) {
// TODO: error, not a valid kernel
return NULL;
}
convolution filter is enabled (it is enabled by default via BUILTIN_FILTERS)./unsafe/ URLs are allowed (ALLOW_UNSAFE_URL=True), OR/unsafe/ is disabled, and the attacker has a valid signed URL (i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service).http://<host>:<port>/<url-sign>/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg
http://<host>:<port>/unsafe/400x400/filters:convolution(1;2;1;2;4;2;1;2;1,0,true)/example.jpg
/unsafe/ is enabled: unauthenticated remote DoS./unsafe/ is disabled: the attacker needs a valid signed URL.(i.e., the attacker is an authorized user/partner, or can obtain signed URLs from a trusted signing service)thumbor/ext/filters/_convolution.c):columns_count <= 0 before any % or /.thumbor/filters/convolution.py):columns to be non-zero (e.g., use BaseFilter.PositiveNonZeroNumber).Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.