CVE-2024-0419

Executive Summary

CVE-2024-0419 is a denial of service (DoS) vulnerability affecting Jasper httpdx up to version 1.5.4. The flaw resides in the HTTP POST Request Handler component, allowing a remote attacker to cause a denial of service via unspecified manipulation. With a CVSS score of 5.3 (Medium), the vulnerability is remotely exploitable without authentication. Public exploit details have been disclosed, increasing the risk of active exploitation. No official patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L)

The threat level is elevated due to the public availability of exploit details and the lack of a patch. The low EPSS score (0.0%) suggests limited current exploitation, but this may change.

Deep Dive & Mechanics

The vulnerability is triggered by sending a specially crafted HTTP POST request to the Jasper httpdx server. The exact manipulation is not fully detailed, but it leads to resource exhaustion or a crash, resulting in denial of service. The attack is remotely exploitable and requires no authentication, making it a significant risk for exposed instances.

The root cause is likely improper handling of POST request data, such as excessive payload size, malformed headers, or infinite loops in request processing. This aligns with CWE-400 (Uncontrolled Resource Consumption).

Vulnerable vs. Patched Code

No official patch is available. The vulnerable code is in the HTTP POST Request Handler of Jasper httpdx versions <= 1.5.4. Without a patch, the only mitigation is to restrict access or disable the service.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy Jasper httpdx 1.5.4 on a test VM (e.g., Ubuntu 20.04).
2. Exploit: Use a crafted HTTP POST request to trigger the DoS. Example using curl:

   curl -X POST -d "$(python3 -c 'print("A"*1000000)')" http://target:8080/
   

   This sends a large payload that may exhaust server resources.
3. Verification: Monitor the target service; it should become unresponsive or crash.

Blue Team

1. Detection: Monitor for unusually large POST requests or repeated connection attempts.
2. Mitigation: Implement rate limiting and request size restrictions at the network perimeter (e.g., using a reverse proxy like Nginx).
3. Hunting: Search logs for patterns of large POST bodies or rapid connection failures.

Indicators of Compromise (IOCs)

• Network: High volume of POST requests with large payloads (>1MB) to the httpdx service.
• Logs: Repeated HTTP 500 errors or connection timeouts in server logs.
• System: High CPU or memory usage on the httpdx server process.

Detection Engineering

YARA Rule

rule CVE_2024_0419_httpdx_dos {
    meta:
        description = "Detects potential DoS attempts against Jasper httpdx via large POST requests"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0419"
    strings:
        $http_post = "POST" ascii nocase
        $large_body = /Content-Length:\s*[0-9]{7,}/ ascii
    condition:
        $http_post and $large_body
}

Sigma Rule

title: CVE-2024-0419 - Jasper httpdx DoS via Large POST Request
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects large POST requests targeting Jasper httpdx service
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        sc-status: 500
        cs-uri-query|contains: '/'
    condition: selection
falsepositives:
    - Legitimate large file uploads
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-0419 - Jasper httpdx DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"Content-Length|3a|"; distance:0; pcre:"/Content-Length:\s*[0-9]{7,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Restrict network access to the httpdx service using a firewall or ACL. Only allow trusted IPs.
• Short-term: Implement a reverse proxy (e.g., Nginx) to filter large POST requests and rate-limit connections.
• Long-term: Monitor for official patches from Jasper. If none are released, consider migrating to an alternative HTTP server.
• Workaround: Disable the HTTP POST handler if not required, or limit the maximum request body size in the server configuration.

Valters IT