CVE-2024-24754

Executive Summary

CVE-2024-24754 is a moderate-severity vulnerability in Bref, a framework enabling serverless PHP applications on AWS Lambda. The flaw resides in the Event-Driven Function runtime when handling multipart HTTP requests. During the conversion of a Lambda event to a PSR-7 object, keys ending with an open square bracket ([) are parsed differently compared to standard PHP. This discrepancy can lead to application logic bypasses, data integrity issues, and potential security vulnerabilities depending on how the parsed body is used. The vulnerability is patched in Bref version 2.1.13.

Supply Chain & Package Security

Bref is distributed as a Composer package (bref/bref). Users relying on the Event-Driven Function runtime with RequestHandlerInterface are affected. The vulnerability is not in PHP itself but in Bref's multipart parsing logic. Ensure your composer.json requires "bref/bref": ">=2.1.13" to mitigate supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Score: 3.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: High (requires crafted multipart request with specific key naming)
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (potential manipulation of parsed body data)
• Availability Impact: None

Threat Level: Low. Exploitation requires specific conditions and the impact is limited to data integrity within the application's request handling.

Deep Dive & Mechanics

The vulnerability arises from Bref's custom multipart body parser used when converting an AWS Lambda event to a PSR-7 ServerRequestInterface. In standard PHP, when a multipart form field name ends with [, PHP treats it as an array key and appends subsequent values to that array. Bref's parser, however, does not replicate this behavior correctly, leading to a different structure in the $parsedBody and $files arrays.

For example, a field named field[ with value value1 in PHP would result in $_POST['field'][''] = 'value1'. Bref's parser might produce $parsedBody['field['] = 'value1' or another inconsistent structure. This mismatch can cause applications that rely on the standard PHP parsing behavior to malfunction or be exploited.

Attack Scenario: An attacker sends a crafted multipart request with keys ending in [. If the application logic uses these keys for authorization, input validation, or data processing, the attacker could bypass checks or inject unexpected data.

Vulnerable vs. Patched Code

Vulnerable (Bref < 2.1.13): The multipart parser in src/Event/Http/LambdaEvent.php (or similar) does not handle trailing [ in field names. It treats them as literal characters.

// Vulnerable pseudocode
foreach ($parts as $part) {
    $name = $part['name'];
    $value = $part['body'];
    $parsedBody[$name] = $value; // No array handling for trailing [
}

Patched (Bref >= 2.1.13): The parser now mimics PHP's behavior by detecting trailing [ and creating nested arrays.

// Patched pseudocode
foreach ($parts as $part) {
    $name = $part['name'];
    $value = $part['body'];
    if (substr($name, -1) === '[') {
        $name = substr($name, 0, -1);
        $parsedBody[$name][] = $value; // Append to array
    } else {
        $parsedBody[$name] = $value;
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Bref-based serverless PHP application using Event-Driven Function runtime with RequestHandlerInterface.
• The application must process multipart form data and use the parsed body for security decisions.

Exploitation Steps:

1. Identify an endpoint that accepts multipart POST requests.
2. Craft a request with a field name ending in [, e.g., admin[ with value true.
3. Send the request. The application may interpret the parsed body differently than intended, potentially bypassing access controls or injecting data.

Example cURL command:

curl -X POST https://your-lambda-url.execute-api.region.amazonaws.com/endpoint \
  -F "admin[=true" \
  -F "username=attacker"

Blue Team

Detection:

• Monitor for multipart requests with unusual field names (e.g., containing [ at the end).
• Log and alert on discrepancies between raw request body and parsed application data.

Mitigation:

• Update Bref to version 2.1.13 or later.
• Implement input validation that normalizes field names before processing.
• Use a Web Application Firewall (WAF) to block requests with suspicious multipart field names.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests with multipart/form-data containing field names ending with [.
• Application Logs: Unexpected array structures in $parsedBody or $files variables.
• Behavior: Application logic bypasses or data integrity issues in features relying on multipart input.

Detection Engineering

YARA Rule

rule CVE_2024_24754_Multipart_Key_Anomaly {
    meta:
        description = "Detects multipart form data with field names ending in open bracket"
        author = "Valters IT"
        date = "2024-10-27"
        cve = "CVE-2024-24754"
    strings:
        $multipart = "multipart/form-data" nocase
        $bracket_key = /name="[^"]*\["/ 
    condition:
        $multipart and #bracket_key > 0
}

Sigma Rule

title: CVE-2024-24754 - Bref Multipart Parsing Anomaly
id: 8a3f2c1e-5b7d-4a9f-8c6e-1d2f3a4b5c6d
status: experimental
description: Detects HTTP requests with multipart form data containing field names ending with an open bracket
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.request.body|contains: 'name="' 
        http.request.body|endswith: '["'
    condition: selection
falsepositives:
    - Legitimate use of array-like field names in some applications
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24754 - Bref Multipart Key Anomaly"; flow:to_server; content:"multipart/form-data"; http_header; pcre:"/name=\"[^\"]*\[\"/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update Bref to version 2.1.13 or later via Composer:

   composer require bref/bref:^2.1.13
   

2. Validation: Implement server-side validation to normalize multipart field names before processing.
3. Monitoring: Deploy detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.
4. WAF: Configure Web Application Firewall rules to block requests with field names ending in [.
5. Audit: Review application logic that relies on multipart body parsing for potential security impacts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert