CVE-2024-24753

Executive Summary

CVE-2024-24753 is a security vulnerability in Bref, a framework enabling serverless PHP applications on AWS Lambda. The flaw resides in how Bref handles HTTP responses when used with API Gateway v2 format. Specifically, when a PHP application generates multiple HTTP headers with the same key (e.g., two Content-Security-Policy headers), Bref only retains the last header value, discarding all previous ones. This behavior can weaken security mechanisms that rely on multiple headers with the same key, such as Content Security Policy (CSP) or Set-Cookie. The vulnerability has a CVSS score of 4.8 (Medium) and is patched in Bref version 2.1.13.

Supply Chain & Package Security

This vulnerability affects the Bref package, which is distributed via Composer (PHP package manager). Users who install Bref via composer require bref/bref are impacted if they use a version prior to 2.1.13. The supply chain risk is moderate, as the vulnerability is in the runtime layer that processes HTTP responses, potentially affecting any application using Bref with API Gateway v2.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium because the vulnerability allows an attacker to bypass security policies (e.g., CSP) by exploiting the header handling flaw. However, it does not directly lead to data disclosure or system compromise.

Deep Dive & Mechanics

Bref acts as a bridge between AWS API Gateway and PHP applications running on Lambda. When API Gateway v2 format is used, Bref processes the response from PHP and converts it into the format expected by API Gateway. The vulnerability occurs in the response transformation logic.

In a standard HTTP response, multiple headers with the same key are allowed (e.g., multiple Set-Cookie headers). However, Bref's implementation for API Gateway v2 only keeps the last value when multiple headers with the same key are present. This is because the code likely uses a dictionary/map structure that overwrites previous values when the same key is encountered.

For example, if a PHP application sets:

Content-Security-Policy: default-src 'self'
Content-Security-Policy: script-src 'unsafe-inline'

Bref would only output:

Content-Security-Policy: script-src 'unsafe-inline'

This can allow an attacker to bypass CSP restrictions if the first header was more restrictive.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.1.13):

// Simplified representation of header handling
$headers = [];
foreach ($response->getHeaders() as $name => $values) {
    // Only keeps the last value
    $headers[$name] = end($values);
}

Patched Code (2.1.13+):

// Correctly handles multiple headers
$headers = [];
foreach ($response->getHeaders() as $name => $values) {
    foreach ($values as $value) {
        $headers[] = [$name, $value];
    }
}

The patched version ensures all header values are preserved by using an array of tuples instead of a single-value map.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would need to find a PHP application using Bref that sets multiple headers with the same key for security purposes. The attacker would then craft a request that triggers the application to generate such headers, and observe that only the last header is reflected.

Lab Setup:

1. Deploy a Bref application (version < 2.1.13) on AWS Lambda with API Gateway v2.
2. Create a PHP endpoint that returns multiple Content-Security-Policy headers:

   <?php
   header("Content-Security-Policy: default-src 'self'");
   header("Content-Security-Policy: script-src 'unsafe-inline'", false);
   echo "Hello";
   

3. Access the endpoint and observe the response headers using curl -I.
4. Note that only the second CSP header is present.

Blue Team

To detect exploitation attempts:

• Monitor API Gateway logs for unusual response header patterns.
• Check for missing security headers in responses.
• Use the detection rules below.

Indicators of Compromise (IOCs)

• Response headers missing expected multiple values (e.g., only one Content-Security-Policy header when multiple should exist).
• Unexpected behavior in security mechanisms (e.g., CSP bypasses).
• Bref version < 2.1.13 in use.

Detection Engineering

YARA Rule

rule CVE_2024_24753_Bref_Header_Handling {
    meta:
        description = "Detects Bref versions vulnerable to CVE-2024-24753"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-24753"
    strings:
        $vuln_func = "getHeaders" ascii nocase
        $vuln_assign = "end($values)" ascii
    condition:
        $vuln_func and $vuln_assign
}

Sigma Rule

title: CVE-2024-24753 Bref Header Handling Vulnerability
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects missing multiple headers in Bref responses
author: Valters IT
logsource:
    category: application
    product: aws_lambda
detection:
    selection:
        response_headers|contains: 
            - "Content-Security-Policy"
            - "Set-Cookie"
    condition: selection and count(response_headers) < expected_count
falsepositives:
    - Applications that intentionally set only one header
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24753 Bref Header Handling"; flow:to_client; content:"Content-Security-Policy"; http_header; pcre:"/Content-Security-Policy: [^\r\n]+/"; threshold: type limit, track by_src, count 1, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Bref to version 2.1.13 or later.
2. Workaround: If upgrade is not possible, avoid relying on multiple headers with the same key for security. Combine values into a single header where possible (e.g., Content-Security-Policy: default-src 'self'; script-src 'unsafe-inline').
3. Long-term: Implement security testing to ensure header handling is correct in serverless environments.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert