CVE-2024-29186

Executive Summary

CVE-2024-29186 is a denial-of-service (DoS) vulnerability in the Bref open-source project, which enables serverless PHP applications on AWS Lambda. The flaw resides in the Event-Driven Function runtime when handling multipart requests. By sending specially crafted multipart requests with slow multi-byte string operations in the Content-Type header of each part, an attacker can cause excessive CPU consumption, leading to increased Lambda execution duration and cost. The vulnerability is rated with a CVSS score of 5.3 (Medium) and affects Bref versions prior to 2.1.17. No public exploit code or proof-of-concept is currently available, but the attack surface is limited to Lambda functions using the Event-Driven Function runtime with a RequestHandlerInterface handler and at least one POST endpoint.

Supply Chain & Package Security

Bref is distributed as a Composer package via Packagist. The vulnerability is introduced through the dependency on the riverline/multipart-parser library, which performs the slow string operations. Users should ensure their composer.json requires "bref/bref": "^2.1.17" and run composer update to obtain the patched version. No malicious package injection has been reported, but the supply chain risk is mitigated by the availability of a fix.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is remotely exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): Low (L) – The attack causes increased resource consumption, leading to potential service degradation or cost spikes.

Threat Level: Medium. The attack is easy to execute but limited to specific configurations and does not result in data breach or system compromise. The primary impact is financial (increased AWS bills) and potential performance degradation.

Deep Dive & Mechanics

The vulnerability is rooted in the StreamedPart::parseHeaderContent function of the riverline/multipart-parser library. When Bref converts a Lambda event to a PSR-7 object, it parses multipart request bodies. For each part, the Content-Type header is read and processed using mb_convert_encoding. The first and third parameters of this function are derived from the header value, allowing an attacker to craft a header that forces the function to perform slow multi-byte string operations.

The attack exploits the fact that mb_convert_encoding can be computationally expensive when given certain character encodings or malformed input. By sending a multipart request with a Content-Type header containing a long or complex encoding string, the server spends significant CPU time processing it. This increases the Lambda execution duration, which is billed per millisecond.

Key Requirements:

• Lambda runtime: Event-Driven Function runtime.
• Handler: RequestHandlerInterface.
• At least one POST endpoint.
• Request size up to 6MB (enough to cause 400-500ms additional duration on default 1024MB RAM Lambda).
• For PHP runtime <= php-82, the impact is higher (up to 900ms additional duration).

Limitations:

• The request header size is limited to ~10KB, so the attack must be carried out via the request body (multipart parts).
• The vulnerability does not affect request headers.

Vulnerable vs. Patched Code

Vulnerable Code (Bref < 2.1.17): The vulnerable code is in the riverline/multipart-parser library, specifically in StreamedPart::parseHeaderContent. The function uses mb_convert_encoding with user-controlled parameters without proper validation or sanitization.

// Vulnerable: $string and $from_encoding are taken directly from the header value
$string = $headerValue;
$from_encoding = $headerValue; // or derived from it
$result = mb_convert_encoding($string, 'UTF-8', $from_encoding);

Patched Code (Bref 2.1.17): The fix involves validating and sanitizing the header value before passing it to mb_convert_encoding. The patch ensures that only allowed encodings are used and that the string is not excessively long.

// Patched: Validate and sanitize input
$allowedEncodings = ['UTF-8', 'ISO-8859-1', ...];
$from_encoding = in_array($headerValue, $allowedEncodings) ? $headerValue : 'UTF-8';
$string = substr($headerValue, 0, 1024); // Limit length
$result = mb_convert_encoding($string, 'UTF-8', $from_encoding);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target Lambda function using Bref with Event-Driven Function runtime and RequestHandlerInterface.
• A POST endpoint that accepts multipart/form-data.

Exploitation Steps:

1. Craft a multipart request with a part that has a malicious Content-Type header. The header should contain a long string of characters that triggers slow mb_convert_encoding operations. For example:

   Content-Type: text/plain; charset=verylongencodingstringthatcausesdelay
   

2. Send the request to the target endpoint. The request body can be up to 6MB to maximize impact.
3. Monitor the Lambda execution duration. The attack will increase the billed duration by 400-900ms per request.

Example cURL command:

curl -X POST https://your-lambda-url.amazonaws.com/endpoint \
  -H "Content-Type: multipart/form-data; boundary=boundary123" \
  --data-binary $'--boundary123\r\nContent-Type: text/plain; charset=verylongencodingstringthatcausesdelay\r\n\r\npayload\r\n--boundary123--'

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor Lambda execution duration for anomalies. A sudden increase in duration for POST requests may indicate exploitation.
• Use AWS CloudWatch Logs to identify requests with unusually long processing times.
• Implement rate limiting on POST endpoints to reduce the impact of repeated attacks.

Mitigation:

• Upgrade to Bref 2.1.17 or later.
• If immediate upgrade is not possible, consider disabling multipart support or implementing a Web Application Firewall (WAF) rule to block requests with suspiciously long Content-Type headers in multipart parts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests with multipart/form-data content type.
  • Request bodies containing parts with Content-Type headers longer than 1024 characters.
  • Unusual patterns in Content-Type charset values (e.g., very long or non-standard encoding names).

• Host IOCs:

  • Lambda function logs showing increased execution duration for POST requests.
  • High CPU utilization in Lambda metrics.

• File IOCs:

  • None specific to this vulnerability.

Detection Engineering

YARA Rule

rule CVE_2024_29186_Multipart_DoS {
    meta:
        description = "Detects malicious multipart requests targeting CVE-2024-29186"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-29186"
    strings:
        $multipart = "multipart/form-data" nocase
        $content_type = "Content-Type:" nocase
        $long_charset = /charset=[a-zA-Z0-9_-]{100,}/ nocase
    condition:
        $multipart and $content_type and $long_charset
}

Sigma Rule

title: CVE-2024-29186 - Bref Multipart DoS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with suspiciously long Content-Type headers in multipart parts
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: aws
detection:
    selection:
        http.method: POST
        http.content_type: "multipart/form-data*"
        http.body|contains: "Content-Type:"
        http.body|re: "charset=[a-zA-Z0-9_-]{100,}"
    condition: selection
falsepositives:
    - Legitimate long charset values (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29186 - Bref Multipart DoS Attempt"; flow:to_server; content:"multipart/form-data"; http_content_type; content:"Content-Type:"; http_client_body; pcre:"/charset=[a-zA-Z0-9_-]{100,}/Ri"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Bref to version 2.1.17 or later: composer require bref/bref:^2.1.17
2. Run composer update to apply the patch.

Long-term Mitigations:

• Implement input validation for multipart headers at the application level.
• Use AWS WAF to block requests with suspiciously long Content-Type headers.
• Monitor Lambda execution duration and set billing alerts to detect cost anomalies.
• Consider using a CDN or API Gateway with request size limits to reduce attack surface.

Workarounds (if upgrade is not possible):

• Disable multipart support in the application.
• Implement a custom middleware that validates multipart headers before processing.

Valters IT